What is the CVSS score of CVE-2025-10035?

CVE-2025-10035 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 58.8%.

Which versions of GoAnywhere MFT are affected by CVE-2025-10035?

Fortra's GoAnywhere Managed File Transfer is experiencing confirmed active exploitation of a critical remote code execution vulnerability that allows unauthenticated remote attackers to achieve…

Is there a public PoC exploit available for CVE-2025-10035?

Yes, a public proof-of-concept exploit is available for CVE-2025-10035. Prioritise patching immediately. EPSS: 58.8%.

How to fix or mitigate CVE-2025-10035?

Within 24 hours: Identify and inventory all GoAnywhere Managed File Transfer deployments; immediately assess network exposure of the License Servlet component and disconnect or restrict any instances accessible from untrusted networks using firewall rules. Within 7 days: Deploy firewall rules limiting License Servlet access to internal IP addresses only, enable detailed audit logging of all License Servlet requests and responses, configure intrusion detection monitoring for exploitation signatures, and establish dedicated on-call incident response capability with forensic tools ready. Within 30 days: Contact Fortra to confirm patch delivery timeline; immediately apply the patch to all GoAnywhere instances upon release; if no patch emerges, initiate urgent evaluation of alternative secure file transfer solutions and develop GoAnywhere decommissioning plan with target completion within 90 days.

GoAnywhere MFT CVE-2025-10035

CRITICAL

Command Injection (CWE-77)

2025-09-18 df4dee71-de3a-4139-9588-11b62fe6c0ff

Command Injection Deserialization Goanywhere Managed File Transfer

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable servlet, no authentication or user interaction once a forged signature is supplied, and deserialization-to-command-injection yields full confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 05:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 05:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Mar 28, 2026 - 19:12 vuln.today

Added to CISA KEV

Oct 24, 2025 - 13:44 cisa

CISA KEV

CVE Published

Sep 18, 2025 - 22:15 nvd

CRITICAL 10.0

DescriptionNVD

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

AnalysisAI

Remote code execution in Fortra's GoAnywhere Managed File Transfer arises when the License Servlet deserializes an attacker-controlled object accompanied by a validly forged license response signature, enabling command injection (CWE-77). Any actor able to forge that signature can reach the servlet over the network without authentication and execute arbitrary commands on the host. This flaw is confirmed actively exploited (CISA KEV), has publicly available exploit code, and carries an unusually high EPSS of 58.80% (98th percentile), placing it firmly in emergency-patch territory.

Technical ContextAI

GoAnywhere MFT is a Java-based enterprise managed file transfer platform typically exposed via a web-facing Admin/Web Client interface. The vulnerable component is the License Servlet, which processes license response data. The root cause is unsafe Java deserialization: the servlet reconstructs a serialized object from a license response after validating its signature, but an attacker who can produce a validly forged signature can smuggle a malicious object graph into the deserialization stream. Per CWE-77 (Command Injection), the deserialized object is leveraged to inject and execute operating-system commands. The two CPE entries (cpe:2.3:a:fortra:goanywhere_managed_file_transfer) confirm the affected product is Fortra's GoAnywhere MFT across unspecified versions; the exact fixed build is defined in Fortra advisory FI-2025-012.

RemediationAI

Apply the fixed release identified in Fortra advisory FI-2025-012 (https://www.fortra.com/security/advisories/product-security/fi-2025-012) as the primary remediation; the input does not contain an exact version string, so administrators must obtain the precise patched build directly from that advisory rather than relying on an assumed number (Patch available per vendor advisory). Because this is confirmed actively exploited (CISA KEV), patch on an emergency basis. As a compensating control until patched, restrict network exposure of the GoAnywhere Admin Console and License Servlet: do not expose the administrative interface to the internet, place it behind a VPN or IP-allowlisted reverse proxy, and block external access to the admin port - trade-off is that remote administrators lose direct access and must connect through the VPN. Additionally, inspect logs for anomalous access to the License Servlet endpoint and for signs of prior compromise, since exploitation has already been observed in the wild. Follow the KEV listing (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035) for BOD 22-01 remediation deadlines if applicable.