CVE-2025-10035

The deserialization vulnerability present in the License Servlet of Fortra's GoAnywhere Managed File Transfer product represents a significant security risk. This type of vulnerability occurs when an application deserializes untrusted data without sufficient validation, allowing an attacker to manipulate the data structure. In this case, an adversary can forge a license response signature, enabling them to inject arbitrary objects into the application. This manipulation can lead to command injection, where the attacker could execute unauthorized commands on the server, potentially compromising the entire system.

Exploitation of this vulnerability can occur through various attack vectors. An attacker with a validly forged license response signature can send crafted requests to the License Servlet, triggering the deserialization process. Once the attacker successfully injects their object, they can execute arbitrary code or commands on the server. This exploitation could be orchestrated remotely, making it accessible to a wide range of potential attackers. The ability to execute commands could lead to unauthorized access to sensitive data, disruption of services, or even complete system takeover, depending on the privileges of the application and the underlying system.

The real-world impact of this vulnerability is profound, particularly for organizations relying on Fortra's GoAnywhere for secure file transfers. The high CVSS score of 9.8 indicates a critical severity level, suggesting that successful exploitation could lead to severe consequences. Businesses could face data breaches, loss of sensitive information, and significant reputational damage. Additionally, regulatory fines and legal repercussions might arise from non-compliance with data protection laws, especially if customer data is compromised. The financial implications of remediation efforts, including incident response, system recovery, and potential loss of business, further exacerbate the risk.

To effectively detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating and patching the GoAnywhere product is crucial, as vendors often release updates to address known vulnerabilities. Conducting thorough security assessments and penetration testing can help identify weaknesses in the application and its configurations. Additionally, organizations should employ application firewalls and intrusion detection systems to monitor for unusual patterns of behavior that may indicate exploitation attempts. Implementing strict input validation and sanitization measures can also help prevent unauthorized data manipulation during the deserialization process.

In conclusion, the deserialization vulnerability in Fortra's GoAnywhere Managed File Transfer product poses a significant threat to organizations utilizing this software. The potential for command injection and the associated risks highlight the importance of robust security practices. By prioritizing timely updates, proactive security assessments, and stringent input validation, organizations can mitigate the risks associated with this vulnerability and protect their sensitive data and systems from malicious actors.

CSURFACE threat intelligence has detected a marked escalation in activity exploiting the deserialization vulnerability in Fortra’s GoAnywhere MFT License Servlet. Our telemetry indicates a significant uptick in exploitation attempts, reflecting growing adversary interest despite a slight decline in the EPSS score. This divergence suggests that while automated risk scoring adjusts downward, real-world targeting by threat actors—including ransomware groups such as Storm-1175 and variants of LockBit—remains persistent and intensifying. The emergence of multiple new proof-of-concept exploits publicly available on GitHub further lowers the barrier for attackers to weaponize this vulnerability, increasing the likelihood of successful intrusions. Given the known association with ransomware campaigns and the critical severity of the flaw, defenders should regard the threat level as elevated. The increased exploitation activity underscores the urgency for heightened monitoring and response capabilities within environments running the affected software.

Update 2 — May 20, 2026

CSURFACE threat intelligence has recorded a marked reduction in detection activity related to CVE-2025-10035, despite the vulnerability’s CVSS score being elevated to a perfect 10.0. This adjustment reflects a refined understanding of the exploit’s potential impact, underscoring its criticality in enabling remote command injection through deserialization. Concurrently, the Exploit Prediction Scoring System (EPSS) score has increased modestly, indicating a slightly heightened likelihood of exploitation attempts in the near term. The inclusion of this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, coupled with its confirmed use by ransomware groups such as Storm-1175 and LockBit variants, affirms its strategic value to threat actors. The presence of multiple new proof-of-concept exploits on public repositories continues to lower the barrier for adversaries to weaponize this flaw, even as observed exploitation attempts have temporarily declined. This dynamic suggests a potential shift in attacker tactics or a pause preceding renewed activity. Overall, the threat level remains critically high, with the updated scoring and KEV listing reinforcing the urgency for vigilant monitoring and proactive defense within environments running Fortra GoAnywhere MFT.

Update 3 — June 09, 2026

The recent adjustment of CVE-2025-10035’s CVSS score from 10.0 to 9.8, alongside an increase in its EPSS score, reflects a refined understanding of its exploitability and impact. CSURFACE threat intelligence notes that while the vulnerability remains critically severe, the slight downward revision in CVSS suggests nuanced reassessment of exploit conditions or impact metrics. Concurrently, the upward trend in EPSS indicates a growing likelihood of exploitation attempts in the near term, corroborated by the vulnerability’s inclusion in the KEV catalog with a defined due date and confirmed use in ransomware campaigns by groups such as Storm-1175 and LockBit variants. Our telemetry continues to detect the proliferation of new proof-of-concept exploits on public platforms, which lowers the technical barrier for adversaries and sustains the risk of opportunistic exploitation. Although direct exploitation attempts have not surged markedly, the combination of increased EPSS and active ransomware targeting underscores an elevated threat posture. Defenders should interpret these developments as a signal that adversaries remain actively interested and capable of leveraging this flaw, maintaining the vulnerability’s critical status within operational risk frameworks.