CVE-2025-10035: deserialization in Fortra GoAnywhere MFT

CVE-2025-10035 is a deserialization vulnerability in the License Servlet of Fortra GoAnywhere MFT software. An attacker possessing a validly forged license response signature can force deserialization of an arbitrary attacker-controlled object, potentially leading to command injection. It impacts environments using the Fortra managed file transfer service.

The CVSS score is set at 10.0, the maximum possible score, with a declared critical severity. The vulnerability was published by NVD on 2025-09-18. As of 2026-10-30, signals from social media platforms indicate continued interest and activity around this flaw, though sources are not officially verified.

System administrators and IT teams must immediately verify if GoAnywhere MFT is present in their infrastructure and which version is deployed. Consult Fortra security advisories to identify applicable patches. Apply updates as soon as they become available. Monitor logs on affected systems for anomalous deserialization activity or unexpected command execution.

The absence of public signals on GitHub repositories does not exclude the existence of private exploits. Given the maximum CVSS score and critical nature of this vulnerability, assume that exploitation is potentially widespread. Educate your teams on the distinction between a known flaw and public signals: silence on GitHub does not equate to security.