CVE-2025-10035

This is a deserialization flaw in the License Servlet of Fortra's GoAnywhere MFT. The servlet deserializes a license response object, and if an attacker can present a license signature that the server accepts as valid, it will deserialize an arbitrary, attacker-controlled object. That reconstruction triggers a gadget chain leading to command injection on the host. The gating condition is forging a valid signature, but where that is achievable the outcome is unauthenticated code execution on the file-transfer server.

GoAnywhere MFT is a managed file-transfer product, the same high-value category behind the Clop group's MOVEit and earlier GoAnywhere campaigns, so the data it holds is exactly the regulated, sensitive material organizations move between partners, and these servers are commonly internet-facing. Fortra's own prior GoAnywhere zero-day was mass-exploited by Clop for extortion, which sets the expectation for how fast this class draws weaponization once details circulate. Patch to the fixed GoAnywhere release immediately, and as defense-in-depth ensure the admin console and license servlet are not exposed to the internet. Given the track record, hunt for signs of command execution and anomalous data egress rather than relying on the patch alone.