{"id":"CVE-2025-10035","published":"2025-09-18T22:15:41Z","modified":"2026-10-18T21:10:00Z","title":"Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability","vendor":"Fortra","product":"GoAnywhere MFT","tier":"core","eol":null,"description":{"text":"A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.","provenance":"source","from":"NVD"},"summary":{"text":"A deserialization flaw in the License Servlet of Fortra's GoAnywhere MFT product allows an actor to deserialize an arbitrary object they control, which can possibly lead to command injection. Exploitation requires the attacker to present a validly forged license response signature, and no user interaction or prior authentication is needed when the attacker has network access to the affected service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:21Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99823,"percentile":0.9996,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-09-29","dueDate":"2025-10-20","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.fortra.com/security/advisories/product-security/fi-2025-012 ; https://nvd.nist.gov/vuln/detail/CVE-2025-10035","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-09-25","exploitedFirstSeen":"2025-09-25","ransomware":true,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-10035","date":"2025-09-25"},{"url":"https://labs.watchtowr.com/it-is-bad-exploitation-of-fortra-goanywhere-mft-cve-2025-10035-part-2/","date":"2025-09-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-09-29"},{"url":"https://cyble.com/blog/critical-vulnerabilities-cyble-weekly-report/","date":"2025-09-30"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/","date":"2025-10-06"},{"url":"https://www.fortiguard.com/outbreak-alert/goanywhere-mft-attack","date":"2025-10-07"},{"url":"https://www.fortra.com/blog/summary-investigation-related-cve-2025-10035","date":"2025-10-09"},{"url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligece-report-06-oct-2025-e70ce7615386","date":"2025-10-22"},{"url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligece-report-13-oct-2025-b33e60550f1d","date":"2025-10-22"},{"url":"https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf","date":"2025-11-12"}],"evidenceTotal":33,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.fortra.com/security/advisories/product-security/fi-2025-012","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploited via public-facing License Servlet endpoint","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT","start":0,"end":81}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection yields arbitrary command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"possibly leading to command injection","start":200,"end":237}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-733f5480456da2725571","title":"#StopRansomware: Medusa Ransomware","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a","date":null,"mentions":[{"quote":"18, 2026) Fortra GoAnywhere vulnerability CVE-2025-10035 [CWE-502: Deserialization of Untrusted Data].","start":4961,"end":5063},{"quote":"18, 2026) Fortra GoAnywhere vulnerability CVE-2025-10035 [CWE-502: Deserialization of Untrusted Data].","start":5378,"end":5480}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-30225","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-30225","exploited":true,"exploitedSince":"2025-09-29","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2025-09-20","earliestUrl":"https://github.com/rxerium/CVE-2025-10035","repos":[{"name":"rxerium/CVE-2025-10035","url":"https://github.com/rxerium/CVE-2025-10035","stars":18,"created":"2025-09-20"},{"name":"ThemeHackers/CVE-2025-10035","url":"https://github.com/ThemeHackers/CVE-2025-10035","stars":1,"created":"2025-09-21"},{"name":"orange0Mint/CVE-2025-10035_GoAnywhere","url":"https://github.com/orange0Mint/CVE-2025-10035_GoAnywhere","stars":0,"created":"2025-09-27"},{"name":"sentinel-aidefense/CVE-2025-10035","url":"https://github.com/sentinel-aidefense/CVE-2025-10035","stars":0,"created":"2026-07-10"},{"name":"dkchaiv/CVE-2025-10035","url":"https://github.com/dkchaiv/CVE-2025-10035","stars":0,"created":"2026-10-28"}]},"nuclei":[{"id":"CVE-2025-10035","name":"GoAnywhere - Authentication Bypass","severity":"critical","path":"http/cves/2025/CVE-2025-10035.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10035.yaml"}],"first":{"date":"2025-09-20","source":"PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-10035"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential Exploitation of GoAnywhere MFT Vulnerability","id":"6c76b3d0-afe4-4870-9443-ffe6773c5fef","level":"high","status":"experimental","path":"rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml","techniques":["T1190","T1059.001","T1133"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-09-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10035","provenance":"source"},{"date":"2025-09-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-10035","provenance":"source"},{"date":"2025-09-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-10035","provenance":"source"},{"date":"2025-09-29","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-09-29","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-30225","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":11},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 400 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}