CVE-2025-10035: Fortra GoAnywhere MFT License Servlet deserialization to command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network reach, KEV listing with ransomware use and an EPSS near 1.0 make this an urgent patch-first issue.

What it is

The License Servlet in Fortra GoAnywhere MFT deserializes untrusted data, and an attacker who can present a validly forged license response signature can supply an arbitrary object for deserialization. That path can lead to command injection, giving remote code execution on the MFT server. Because GoAnywhere is a file transfer gateway, compromise exposes both the host and the data moving through it.

Impact

An attacker gains remote code execution on the GoAnywhere MFT server, with high impact to confidentiality, integrity and availability. From there they can read or alter transferred files, harvest credentials and pivot into connected networks.

Attack surface

Reachable over the network through the License Servlet with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description adds a precondition: the actor must be able to forge a valid license response signature.

Exploitation

Listed in CISA KEV since 2025-09-29 with a 2025-10-20 remediation due date and flagged for known ransomware campaign use. EPSS is 0.99799 (99.957th percentile), indicating near-certain exploitation activity.

What to do

• Apply the Fortra vendor fix for the License Servlet deserialization issue per advisory FI-2025-012; treat this as urgent given KEV status.
• If patching cannot be completed by the KEV due date, follow vendor mitigations or discontinue use of the product, as CISA directs.
• Restrict network access to the GoAnywhere administrative and license interfaces so only trusted management hosts can reach them.
• Rotate license signing material and any credentials or keys stored on or used by the GoAnywhere host, assuming compromise.
• Hunt for prior compromise on internet-facing GoAnywhere instances before restoring normal operations.

Detection

• Monitor GoAnywhere logs and network traffic for requests to the License Servlet, especially from unexpected or external source addresses.
• Alert on unexpected child processes spawned by the GoAnywhere Java process, which would indicate command injection.
• Watch for outbound connections from the GoAnywhere host to unfamiliar destinations, consistent with post-exploitation or ransomware staging.
• Review file system and configuration changes on the GoAnywhere server for tampering with license or servlet components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.