What is the CVSS score of CVE-2025-10035?

CVE-2025-10035 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 58.8%.

Which versions of Goanywhere Managed File Transfer are affected by CVE-2025-10035?

CVE-2025-10035 presents critical security risk, a command injection vulnerability rated CVSS 10.0.

Is CVE-2025-10035 being actively exploited?

Yes, CVE-2025-10035 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-10035?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Goanywhere Managed File Transfer CVE-2025-10035

CRITICAL

Command Injection (CWE-77)

2025-09-18 df4dee71-de3a-4139-9588-11b62fe6c0ff

Deserialization Command Injection Goanywhere Managed File Transfer

10.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:12 vuln.today

Added to CISA KEV

Oct 24, 2025 - 13:44 cisa

CISA KEV

CVE Published

Sep 18, 2025 - 22:15 nvd

CRITICAL 10.0

DescriptionNVD

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

AnalysisAI

Fortra GoAnywhere MFT contains a deserialization vulnerability in the License Servlet allowing command injection through crafted license response signatures.

Technical ContextAI

The CWE-77 command injection through deserialization in the License Servlet processes crafted objects when a validly forged license signature is presented.

RemediationAI

Apply Fortra patches. Monitor for unauthorized license updates. Review file transfer logs for data exfiltration.

CVE-2025-10035 vulnerability details – vuln.today

Back

Goanywhere Managed File Transfer CVE-2025-10035

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code