CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Other sources
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortra GoAnywhere MFTto a version that resolves this vulnerability.Fixed in 7.8.4 - Upgrade
Upgrade
Fortra GoAnywhere MFTto a version that resolves this vulnerability.Fixed in 7.6.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10035?
CVE-2025-10035 has been rated with a high severity due to the potential for command injection.
How do I fix CVE-2025-10035?
To fix CVE-2025-10035, apply the latest security patch released by Fortra for GoAnywhere MFT.
What types of systems are affected by CVE-2025-10035?
CVE-2025-10035 affects the License Servlet of Fortra's GoAnywhere MFT software.
What is the impact of exploiting CVE-2025-10035?
Exploiting CVE-2025-10035 could allow an attacker to execute arbitrary commands on the server.
Who is responsible for the CVE-2025-10035 vulnerability?
The CVE-2025-10035 vulnerability is associated with Fortra's GoAnywhere MFT software.