Security readout for executives and security teams
Plain-English summary
GoAnywhere MFT contains a critical flaw that could let an unauthenticated attacker compromise the system after forging a valid license-response signature. Successful exploitation may allow command execution, threatening transferred files, credentials, connected systems, and service availability.
Executive priority
Treat as an immediate remediation and incident-hunting priority. Active exploitation, unauthenticated network reachability, potential command execution, and a maximum CVSS score create material risks to sensitive file transfers, credentials, operations, and connected environments.
Technical view
The License Servlet can deserialize an attacker-controlled object when supplied with a validly forged license-response signature. The issue combines unsafe deserialization with possible command injection. Its CVSS 3.1 score is 10.0, with network access, low complexity, no privileges, and no user interaction specified.
Likely exposure
GoAnywhere MFT deployments with a reachable License Servlet may be exposed, especially when accessible from untrusted networks. The bundle lists an affected version value of “0,” which is not an actionable version range; administrators must use Fortra’s advisory to determine affected builds.
Exploitation context
CISA lists CVE-2025-10035 in its Known Exploited Vulnerabilities catalog, supporting active exploitation in the wild. The supplied evidence does not describe attack volume, targeted organizations, observed indicators, or the method used to forge license-response signatures.
Researcher notes
The exploitation prerequisite is a validly forged license-response signature, followed by attacker-controlled deserialization. The provided bundle does not establish the affected version range, patched versions, indicators of compromise, or exploitation mechanics. Avoid treating the listed version value “0” as meaningful product-version guidance.
Mitigation direction
- Review Fortra advisory FI-2025-012 and apply its prescribed remediation immediately.
- Restrict untrusted network access to GoAnywhere MFT while remediation is pending.
- Isolate suspected systems and preserve relevant application, proxy, authentication, and endpoint logs.
- Review connected credentials and rotate them if compromise is suspected.
Validation and detection
- Inventory GoAnywhere MFT deployments and compare exact builds against Fortra’s advisory.
- Determine whether the License Servlet is reachable from untrusted networks.
- Review telemetry for unusual servlet requests, unexpected child processes, or command execution.
- Confirm the vendor-prescribed remediation is installed on every deployment.
- Retest network exposure after remediation without attempting exploitation.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-10035 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96FortraVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-10035 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-09-29T00:00:00.000Z: CVE-2025-10035 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://www.fortra.com/security/advisories/product-security/fi-2025-012CVE reference, Fortra
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.