CVE-2025-10035 is a deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT that lets an attacker who can forge a valid license response signature deserialize an arbitrary, attacker-controlled object, leading to command injection and remote code execution, and CISA confirms it has been used in ransomware campaigns.
Vulnerability summary
9.8
Critical
99.8%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-09-18
Published
Vulnerability ID: CVE-2025-10035 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Fortra GoAnywhere Managed File Transfer | cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:* | through 7.6.2 (fixed in 7.6.3); 7.7.0 through 7.8.3 (fixed in 7.8.4), per NVD CPE applicability data |
What this means
CVE-2025-10035 (CWE-502 deserialization of untrusted data, chained to CWE-77 command injection) is in the License Servlet of Fortra's GoAnywhere Managed File Transfer (MFT). NVD's description states the flaw "allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection" (NVD).
NVD's own analysis scores it CVSS v3.1 9.8 (critical, Primary), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required; the submitting CNA scores the same flaw 10.0 with scope changed, reflecting that a compromised MFT instance typically touches systems well beyond itself (NVD).
Fortra's own advisory, FI-2025-012 ("Deserialization Vulnerability in GoAnywhere MFT's License Servlet"), is the vendor source NVD cites for remediation; it documents the fix in GoAnywhere MFT 7.8.4, with 7.6.3 covering earlier release lines (Fortra Security Advisory FI-2025-012).
CISA added CVE-2025-10035 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-09-29, recording known use in ransomware campaigns, with a required-action due date of 2025-10-20 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.99823 (99.96th percentile), among the highest EPSS scores tracked, consistent with a managed-file-transfer RCE that follows the same high-value target pattern as prior MOVEit- and GoAnywhere-class incidents (FIRST EPSS).
Because GoAnywhere MFT instances are frequently internet-facing and handle sensitive file transfers, any instance on an affected build should be patched to 7.8.4 (or 7.6.3) immediately, with license-servlet access restricted and logs reviewed for signs of prior exploitation given the confirmed ransomware use.
Evidence
- Deserialization vulnerability in GoAnywhere MFT's License Servlet lets an actor with a forged license response signature deserialize an arbitrary object, possibly leading to command injection. — NVD
- CVSS v3.1 base score is 9.8 (critical, NVD Primary), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the submitting CNA scores it 10.0 with scope changed. — NVD
- Vendor advisory FI-2025-012 ("Deserialization Vulnerability in GoAnywhere MFT's License Servlet") is Fortra's official remediation source; fix ships in GoAnywhere MFT 7.8.4 (7.6.3 for earlier release lines). — Fortra Security Advisory FI-2025-012
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-09-29, due date 2025-10-20, with known ransomware campaign use. — CISA KEV
- EPSS score is 0.99823 (99.96th percentile) as of 2026-10-29. — FIRST EPSS
