Fortra warns of max severity flaw in GoAnywhere MFT’s License Servlet

Fortra has released security updates to patch a maximum severity vulnerability in GoAnywhere MFT's License Servlet that can be exploited in command injection attacks. GoAnywhere MFT is a web-based managed file transfer tool that helps organizations securely transfer files and maintain audit logs of who accesses the shared files. Tracked as CVE-2025-10035, this security flaw is caused by a deserialization of untrusted data weakness and can be exploited remotely in low-complexity attacks that don't require user interaction. While Fortra stated that the vulnerability was discovered over the weekend, it didn't specify who reported it or whether the flaw has been exploited in attacks. "A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection," the company said in a security advisory published on Thursday. "During a security check conducted September 11, 2025, we identified that GoAnywhere customers with an Admin Console accessible over the internet could be vulnerable to unauthorized third-party exposure," Fortra told BleepingComputer today. "We immediately developed a patch and offered customers mitigation guidance to help resolve the issue. Customers should review configurations immediately and remove public access from the Admin Console." The company has released GoAnywhere MFT 7.8.4 and Sustain Rel...