CVE-2025-10035

The deserialization vulnerability present in the License Servlet of Fortra's GoAnywhere Managed File Transfer product represents a significant security risk. This type of vulnerability occurs when an application deserializes untrusted data without sufficient validation, allowing an attacker to manipulate the data structure. In this case, an adversary can forge a license response signature, enabling them to inject arbitrary objects into the application. This manipulation can lead to command injection, where the attacker could execute unauthorized commands on the server, potentially compromising the entire system.

Exploitation of this vulnerability can occur through various attack vectors. An attacker with a validly forged license response signature can send crafted requests to the License Servlet, triggering the deserialization process. Once the attacker successfully injects their object, they can execute arbitrary code or commands on the server. This exploitation could be orchestrated remotely, making it accessible to a wide range of potential attackers. The ability to execute commands could lead to unauthorized access to sensitive data, disruption of services, or even complete system takeover, depending on the privileges of the application and the underlying system.

The real-world impact of this vulnerability is profound, particularly for organizations relying on Fortra's GoAnywhere for secure file transfers. The high CVSS score of 9.8 indicates a critical severity level, suggesting that successful exploitation could lead to severe consequences. Businesses could face data breaches, loss of sensitive information, and significant reputational damage. Additionally, regulatory fines and legal repercussions might arise from non-compliance with data protection laws, especially if customer data is compromised. The financial implications of remediation efforts, including incident response, system recovery, and potential loss of business, further exacerbate the risk.

To effectively detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating and patching the GoAnywhere product is crucial, as vendors often release updates to address known vulnerabilities. Conducting thorough security assessments and penetration testing can help identify weaknesses in the application and its configurations. Additionally, organizations should employ application firewalls and intrusion detection systems to monitor for unusual patterns of behavior that may indicate exploitation attempts. Implementing strict input validation and sanitization measures can also help prevent unauthorized data manipulation during the deserialization process.

In conclusion, the deserialization vulnerability in Fortra's GoAnywhere Managed File Transfer product poses a significant threat to organizations utilizing this software. The potential for command injection and the associated risks highlight the importance of robust security practices. By prioritizing timely updates, proactive security assessments, and stringent input validation, organizations can mitigate the risks associated with this vulnerability and protect their sensitive data and systems from malicious actors.

CSURFACE threat intelligence has detected a marked escalation in activity exploiting the deserialization vulnerability in Fortra’s GoAnywhere MFT License Servlet. Our telemetry indicates a significant uptick in exploitation attempts, reflecting growing adversary interest despite a slight decline in the EPSS score. This divergence suggests that while automated risk scoring adjusts downward, real-world targeting by threat actors—including ransomware groups such as Storm-1175 and variants of LockBit—remains persistent and intensifying. The emergence of multiple new proof-of-concept exploits publicly available on GitHub further lowers the barrier for attackers to weaponize this vulnerability, increasing the likelihood of successful intrusions. Given the known association with ransomware campaigns and the critical severity of the flaw, defenders should regard the threat level as elevated. The increased exploitation activity underscores the urgency for heightened monitoring and response capabilities within environments running the affected software.

Update 2 — May 20, 2026

CSURFACE threat intelligence has recorded a marked reduction in detection activity related to CVE-2025-10035, despite the vulnerability’s CVSS score being elevated to a perfect 10.0. This adjustment reflects a refined understanding of the exploit’s potential impact, underscoring its criticality in enabling remote command injection through deserialization. Concurrently, the Exploit Prediction Scoring System (EPSS) score has increased modestly, indicating a slightly heightened likelihood of exploitation attempts in the near term. The inclusion of this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, coupled with its confirmed use by ransomware groups such as Storm-1175 and LockBit variants, affirms its strategic value to threat actors. The presence of multiple new proof-of-concept exploits on public repositories continues to lower the barrier for adversaries to weaponize this flaw, even as observed exploitation attempts have temporarily declined. This dynamic suggests a potential shift in attacker tactics or a pause preceding renewed activity. Overall, the threat level remains critically high, with the updated scoring and KEV listing reinforcing the urgency for vigilant monitoring and proactive defense within environments running Fortra GoAnywhere MFT.

Update 3 — June 09, 2026

The recent adjustment of CVE-2025-10035’s CVSS score from 10.0 to 9.8, alongside an increase in its EPSS score, reflects a refined understanding of its exploitability and impact. CSURFACE threat intelligence notes that while the vulnerability remains critically severe, the slight downward revision in CVSS suggests nuanced reassessment of exploit conditions or impact metrics. Concurrently, the upward trend in EPSS indicates a growing likelihood of exploitation attempts in the near term, corroborated by the vulnerability’s inclusion in the KEV catalog with a defined due date and confirmed use in ransomware campaigns by groups such as Storm-1175 and LockBit variants. Our telemetry continues to detect the proliferation of new proof-of-concept exploits on public platforms, which lowers the technical barrier for adversaries and sustains the risk of opportunistic exploitation. Although direct exploitation attempts have not surged markedly, the combination of increased EPSS and active ransomware targeting underscores an elevated threat posture. Defenders should interpret these developments as a signal that adversaries remain actively interested and capable of leveraging this flaw, maintaining the vulnerability’s critical status within operational risk frameworks.

Update 4 — July 13, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation activity targeting CVE-2025-10035, evidenced by a doubling in detection frequency within our sensor network. This increase coincides with the emergence of new publicly available exploitation tools, which have lowered the technical barrier for adversaries seeking to leverage the deserialization flaw in Fortra’s GoAnywhere MFT License Servlet. The expanded availability of these tools, combined with ongoing ransomware campaigns by groups such as Storm-1175 and multiple LockBit variants, amplifies the operational risk associated with this vulnerability. While the EPSS score remains stable, the qualitative surge in exploitation attempts and tool proliferation signals heightened adversary interest and capability. Consequently, the threat level should be considered elevated, reflecting a more active exploitation landscape that demands sustained vigilance from defenders.

Update 5 — July 22, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-10035, with telemetry indicating a significant uptick in adversary activity leveraging this deserialization vulnerability. This surge coincides with the continued proliferation of publicly available proof-of-concept exploits, which have become more accessible and varied in technique. The increased exploitation activity appears to be driven in part by ransomware groups such as Storm-1175 and multiple LockBit variants, who are actively integrating this vulnerability into their attack chains. Although the EPSS score remains stable, the qualitative increase in observed attempts and the expanding toolkit ecosystem underscore a heightened operational risk. For defenders, this evolving landscape means that the window for effective detection and response is narrowing as threat actors refine their capabilities and accelerate exploitation efforts. Consequently, the threat level associated with CVE-2025-10035 should be considered elevated, reflecting a more aggressive and persistent adversary posture that demands ongoing attention.

Update 6 — August 14, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2025-10035, reflected by a doubling in detection frequency across our sensors. This surge coincides with the vulnerability’s elevation to a perfect CVSS score of 10.0, underscoring its criticality and the increasing confidence threat actors have in weaponizing this flaw. Notably, the vulnerability’s inclusion in the Known Exploited Vulnerabilities (KEV) catalog and its confirmed use by multiple ransomware groups—including Storm-1175 and LockBit variants—amplify its operational impact. Although the EPSS score remains stable, the qualitative increase in observed exploitation activity and the proliferation of publicly available proof-of-concept exploits demonstrate a rapidly maturing threat landscape. For defenders, this evolution signifies a shrinking window to detect and mitigate attacks before compromise, as adversaries refine their tactics and integrate this vulnerability more aggressively into ransomware campaigns. Consequently, the threat level associated with CVE-2025-10035 should be reassessed as critically elevated, reflecting both heightened exploitation momentum and its strategic value to high-profile ransomware operators.