VULNERABILITY INTELLIGENCE

CVE-2025-10035

CVSS score10 CRITICAL
EPSS probability99.82%
CISA KEVKnown exploited vulnerability
Published2025-09-18
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Known Exploited Vulnerability

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Vendor / product: Fortra / GoAnywhere MFT

Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Weakness classification

  • df4dee71-de3a-4139-9588-11b62fe6c0ff: CWE-77
  • nvd@nist.gov: CWE-77

Primary references