Deserialization Vulnerability in GoAnywhere MFT's License Servlet (CVE-2025-10035)

What is affected, what to do

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update goanywhere_managed_file_transfer to version 7.6.3. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Fortra GoAnywhere MFT lte *..7.8.3

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Remove internet exposure now: Block the GoAnywhere admin console at the perimeter firewall (default ports 8000/HTTP and 8001/HTTPS unless customised). Restrict access to VPN or a jump host in a dedicated admin network. The vulnerable License Servlet is reached through the admin interface.
   • Patch: According to the context, versions 7.6.3 and 7.7.0 through 7.8.4 are affected. A patch is available from the vendor — look up the fixed release in Fortra's advisory for CVE-2025-10035. Snapshot or forensically image the instance before upgrading so evidence is preserved.
   • Compromise assessment before patching: Search the GoAnywhere Admin Audit Log for errors containing SignedObject.getObject. Review all admin and web users for unknown or recently created accounts. Any hit means you treat the host as compromised: isolate it and invoke IR.
   • Rotate credentials: Treat every secret stored in GoAnywhere as exposed and replace it. This covers SFTP/FTPS keys, partner credentials, database and AD service accounts, SMTP relays and API tokens, as well as admin account passwords.
   • Regulatory clock: If compromise is confirmed, prepare the NIS2 24-hour early warning to BSI or your competent authority. Because the platform handles partner data, assume exfiltration and loop in your DPO for GDPR Art. 33.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Host GoAnywhere in a DMZ and keep the admin interface strictly separate from the transfer services (SFTP 22, FTPS, HTTPS client). Allow-list egress from the MFT host so it cannot reach reverse-shell, RMM or C2 infrastructure.
   • WAF/reverse proxy: Deny external requests to /goanywhere/license/*, in particular Unlicensed.xhtml. Allow only internal admin ranges and drop POSTs carrying a bundle= parameter from untrusted sources.
   • Endpoint hardening: Use an EDR policy or AppLocker/WDAC to stop the GoAnywhere Java process from launching shells (cmd.exe, powershell.exe, /bin/sh, bash) or remote-management tools. Run the service under a dedicated, non-privileged account.
   • IAM/least privilege: Keep admin accounts to a minimum and enforce MFA on admin login. Cut GoAnywhere's AD integration accounts down to minimal read rights so a compromise cannot pivot through privileged service accounts.
   • Configuration control: Export the configuration, user list and projects as a baseline. Diff against it regularly to catch persistence such as new projects, triggers or admin users.
3. 03

   Runbook step 3

   Detection rules

   • Web server / proxy logs: Look for requests to /goanywhere/license/Unlicensed.xhtml from non-internal IPs, especially POSTs with large bodies. Example SPL: index=proxy uri_path="*/license/Unlicensed.xhtml*" NOT src_ip IN (10.0.0.0/8,172.16.0.0/12,192.168.0.0/16)
   • Application audit log: Forward the SignedObject.getObject error string from the GoAnywhere Admin Audit Log to the SIEM as a high-severity alert. Also alert on new admin or web users created outside change windows.
   • Process ancestry (Sysmon EID 1 / EDR): Detect a Java process from the GoAnywhere install path spawning a shell. Example KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "java.exe" and InitiatingProcessFolderPath has "GoAnywhere" and FileName in~ ("cmd.exe","powershell.exe","whoami.exe","net.exe"). On Linux, an auditd execve with parent java running as the GoAnywhere service user covers the same case.
   • Windows Security events: On the MFT host, treat Event IDs 4720/4732 (new local account or group addition) and 7045 (new service) as persistence signals. Newly installed RMM agents are a typical example.
   • Network telemetry (Zeek/Suricata): Watch for egress from the MFT host to unknown destinations, especially long-lived TLS sessions, cloud-storage uploads or unusually large outbound volumes (exfiltration with tools such as rclone).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Source: NVD (NIST), CISA KEV Catalog, cvelistv5, CVE.org (MITRE), pwn.watch

Vendors and products

• Fortra Fortra GoAnywhere MFT
• Fortra Goanywhere MFT

Weakness classes (CWE)

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

  Class

  The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

  Entry at MITRE CWE-77

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• fortra.comFortra advisory: Fortra GoAnywhere MFTVendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035government-resource, US government resource
• pwn.watchpwn.watch: Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-10035pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Translated18.10.2026nvd@nist.gov

   • Translation: after Title: GoAnywhere MFT de Fortra, Description: Una vulnerabilidad de deserialización en el License Servlet de GoAnywhere MFT de Fortra permite a un actor con una firma de respuesta de licencia forjada válidamente deserializar un objeto arbitrario controlado por el actor, lo que posiblemente conduzca a la inyección de comandos.