CVE-2025-10035

🗓️ 18 Sep 2025 22:01:51Reported by FortraType

cve🔗 web.nvd.nist.gov📰️ 21 Media mentions👁 526 Views🌐 WEB

GoAnywhere MFT License Servlet deserialization lets forged license signatures deserialize attacker objects, risking command execution.

Reporter	Title	Published	Views	Family All 44
GithubExploit	Exploit for CVE-2025-10035	20 Sep 202507:35	–	githubexploit
GithubExploit	Exploit for CVE-2025-10035	21 Sep 202507:08	–	githubexploit
GithubExploit	Exploit for Command Injection in Fortra Goanywhere_Managed_File_Transfer	10 Jul 202613:16	–	githubexploit
BDU FSTEC	The vulnerability of the Fortra (HelpSystems) GoAnywhere MFT application, related to the restoration of unreliable data in memory, allows a perpetrator to execute arbitrary code.	25 Sep 202500:00	–	bdu_fstec
Circl	CVE-2025-10035	18 Sep 202523:50	–	circl
CISA KEV Catalog	Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability	29 Sep 202500:00	–	cisa_kev
CISA	CISA Adds Five Known Exploited Vulnerabilities to Catalog	29 Sep 202512:00	–	cisa
CNNVD	Fortra GoAnywhere MFT 安全漏洞	18 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-10035 Deserialization Vulnerability in GoAnywhere MFT's License Servlet	18 Sep 202522:01	–	cvelist
EUVD	EUVD-2025-30225	18 Sep 202522:01	–	euvd

NVD

Node

fortra goanywhere_managed_file_transferRange<7.6.3

fortra goanywhere_managed_file_transferRange7.7.0–7.8.4

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Linux",
      "Windows",
      "MacOS"
    ],
    "product": "GoAnywhere MFT",
    "vendor": "Fortra",
    "versions": [
      {
        "lessThanOrEqual": "7.8.3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
fortra	www.fortra.com/security/advisories/product-security/fi-2025-012
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
licenseData	request body	/license	Deserialization of attacker-controlled license data leading to RCE via License Servlet	CWE-502, CWE-77
signature	request body	/license	Deserialization of attacker-controlled license data leading to RCE via License Servlet	CWE-502, CWE-77

04 Aug 2026 05:16Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.19.8 - 10

EPSS0.99799

SSVC

GoAnywhere MFT License Servlet deserialization forged license command execution