GoAnywhere MFT CVE-2025-10035
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing License Servlet
-
DeliveryCraft forged license response signature
-
ExploitEmbed malicious serialized object
-
ExecutionServlet deserializes attacker object
-
PersistTrigger command injection
-
ImpactExecute arbitrary OS commands on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to submit a license response bearing a validly forged signature to the GoAnywhere MFT License Servlet; possessing or being able to generate that valid signature is the concrete prerequisite (implying access to the license signing key or a signature-verification bypass). The affected License Servlet endpoint must be network-reachable - practically, the GoAnywhere Admin Console/servlet exposed to the attacker (internet-facing deployments are highest risk). The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction beyond meeting the forged-signature requirement. The primary limiting factor is therefore the forged signature capability and reachability of the servlet; instances with the admin interface isolated behind a VPN or IP allowlist are substantially harder to reach. |
| Impact | This is a top-priority, act-now vulnerability with strongly aligned signals. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicates network-reachable, low-complexity exploitation with no privileges or user interaction and full CIA impact. This is corroborated rather than contradicted by the other sources: CISA KEV confirms active in-the-wild exploitation, a public exploit is available, and the EPSS score of 58.80% (98th percentile) is exceptionally high, indicating broad, near-term exploitation likelihood. The one nuance worth verifying is the practical barrier of forging a valid license response signature - the description hinges exploitation on 'a validly forged license response signature,' which implies attackers have obtained or bypassed the signing mechanism (a private key leak or verification flaw); this is the real gating condition behind the PR:N rating. No SSVC decision block was provided in the input, so the SSVC exploitation/automatable/technical-impact fields cannot be quoted directly, but KEV+POC+high-EPSS collectively equate to an 'Act' disposition. No conflicting signals were identified. |
| Exploit ScenarioDerived | An attacker with a forged license response signature sends a crafted request to the internet-exposed GoAnywhere MFT License Servlet, embedding a malicious serialized Java object. When the servlet deserializes the object, it triggers command injection and the attacker executes arbitrary OS commands on the server, potentially gaining a foothold to access transferred files or move laterally. Public exploit code exists and this technique is already being used in the wild per CISA KEV, so weaponization is trivial for capable actors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 04, 2026
Remote code execution in Fortra's GoAnywhere Managed File Transfer arises when the License Servlet deserializes an attacker-controlled object accompanied by a validly forged license response signature, enabling command injection (CWE-77). Any actor able to forge that signature can reach the servlet over the network without authentication and execute arbitrary commands on the host. This flaw is confirmed actively exploited (CISA KEV), has publicly available exploit code, and carries an unusually high EPSS of 58.80% (98th percentile), placing it firmly in emergency-patch territory.
Earlier versions of this analysis (1)
A deserialization vulnerability in GoAnywhere MFT's License Servlet enables command injection when an attacker can forge a valid license response signature.
RemediationAI
Apply the fixed release identified in Fortra advisory FI-2025-012 (https://www.fortra.com/security/advisories/product-security/fi-2025-012) as the primary remediation; the input does not contain an exact version string, so administrators must obtain the precise patched build directly from that advisory rather than relying on an assumed number (Patch available per vendor advisory). Because this is confirmed actively exploited (CISA KEV), patch on an emergency basis. As a compensating control until patched, restrict network exposure of the GoAnywhere Admin Console and License Servlet: do not expose the administrative interface to the internet, place it behind a VPN or IP-allowlisted reverse proxy, and block external access to the admin port - trade-off is that remote administrators lose direct access and must connect through the VPN. Additionally, inspect logs for anomalous access to the License Servlet endpoint and for signs of prior compromise, since exploitation has already been observed in the wild. Follow the KEV listing (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035) for BOD 22-01 remediation deadlines if applicable.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GoAnywhere MFT is a Java-based enterprise managed file transfer platform typically exposed via a web-facing Admin/Web Client interface. The vulnerable component is the License Servlet, which processes license response data. The root cause is unsafe Java deserialization: the servlet reconstructs a serialized object from a license response after validating its signature, but an attacker who can produce a validly forged signature can smuggle a malicious object graph into the deserialization stream. Per CWE-77 (Command Injection), the deserialized object is leveraged to inject and execute operating-system commands. The two CPE entries (cpe:2.3:a:fortra:goanywhere_managed_file_transfer) confirm the affected product is Fortra's GoAnywhere MFT across unspecified versions; the exact fixed build is defined in Fortra advisory FI-2025-012.
Know when Goanywhere Managed File Transfer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable servlet, no authentication or user interaction once a forged signature is supplied, and deserialization-to-command-injection yields full confidentiality, integrity, and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Executive ViewAI
Fortra's GoAnywhere Managed File Transfer is experiencing confirmed active exploitation of a critical remote code execution vulnerability that allows unauthenticated remote attackers to achieve complete system compromise. Public exploit code is actively circulating, and no vendor patch currently exists, leaving all deployed instances vulnerable to immediate takeover. Organizations using GoAnywhere face urgent risk of data exfiltration, ransomware deployment, and persistent infrastructure control unless emergency containment measures are deployed within 24 hours.
No vendor-released patch identified at time of analysis. Implement strict firewall-based network access controls permitting License Servlet connections from internal IP ranges only; disable or fully isolate GoAnywhere instances facing untrusted networks; enable comprehensive request-response logging with real-time alerting for suspicious activity; deploy network-based intrusion detection rules for known exploitation signatures; conduct forensic readiness exercises; and maintain elevated incident response posture with 24/7 monitoring until vendor patch availability or complete platform migration is achieved.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Affected Products (CPE)NVD
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the L
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Cons
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-spe
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an a
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with a
When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error
GitHub PoC
Exploit-DB