A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Reports suggest this flaw was exploited in the wild as a zero-day. Apply the available patches as soon as possible.

This GoAnywhere MFT vulnerability received the maximum CVSS score of 10. Threat actors have targeted this software in the past, so immediate patching is highly recommended.

Fortra GoAnywhere MFT is a Managed File Transfer (MFT) solution helping organizations build both internal and external data transfer exchanges. GoAnyWhere MFT versions before 7.8.4 and before 7.6.3 suffer from a deserialization vulnerabilty. By crafting a specific payload, a remote and unauthenticated attacker can achieve remote code execution on the target vulnerable instance.

According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer (MFT) running on the remote web server is prior to 7.6.3 or 7.7.x prior to 7.8.4. It is, therefore, affected by a deserialization vulnerability:

  - A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly     forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command     injection. (CVE-2025-10035)  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115003	Fortra GoAnywhere MFT License Servlet Deserialization Vulnerability	Web App Scanning	Component Vulnerability	critical
265438	Fortra GoAnywhere Managed File Transfer (MFT) < 7.6.3 / 7.7.x < 7.8.4 Deserialization (CVE-2025-10035)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2025-10035

critical

Tenable Plugins

critical

critical