Detections
Analytics

Fortra GoAnywhere Managed File Transfer (MFT) < 7.6.3 / 7.7.x < 7.8.4 Deserialization (CVE-2025-10035)

critical Nessus Plugin ID 265438

Language:

Synopsis

A web application running on the remote server is affected by a deserialization vulnerability.

Description

According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer (MFT) running on the remote web server is prior to 7.6.3 or 7.7.x prior to 7.8.4. It is, therefore, affected by a deserialization vulnerability:

 - A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. (CVE-2025-10035) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Fortra GoAnywhere Managed File Transfer (MFT) 7.6.3 or 7.8.4 or later.

See Also

http://www.nessus.org/u?df0a32ce

Plugin Details

Severity: Critical

ID: 265438

File Name: fortra_goanywhere_mft_7_8_4.nasl

Version: 1.1

Type: combined

Agent: windows

Family: CGI abuses

Published: 9/19/2025

Updated: 9/19/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-10035

CVSS v3

Risk Factor: Critical

Base Score: 10

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:fortra:goanywhere_managed_file_transfer, cpe:/a:helpsystems:goanywhere_managed_file_transfer

Required KB Items: installed_sw/Fortra GoAnywhere MFT

Patch Publication Date: 9/18/2025

Vulnerability Publication Date: 9/18/2025

Reference Information

CVE: CVE-2025-10035