Fortra GoAnywhere MFT 2025: CVE-2025-10035 Exposed Critical Enterprise File Transfers
Executive Summary
In September 2025, Fortra disclosed a critical security vulnerability (CVE-2025-10035) in its GoAnywhere Managed File Transfer (MFT) platform. The flaw, a deserialization weakness in the License Servlet, enabled remote attackers to execute arbitrary commands if they could submit a forged license request. Malicious activity leveraging this zero-day allowed threat actors to gain unauthorized access to sensitive file transfers, escalate privileges, and potentially exfiltrate confidential information before a patch was issued. The vulnerability received a maximum CVSS score of 10.0, emphasizing its severe risk and widespread exploitability.
This incident highlights the ongoing surge in weaponization of zero-day vulnerabilities affecting popular enterprise software. Threat actors are increasingly exploiting deserialization bugs to bypass security controls and facilitate ransomware operations, putting organizations and their supply chains at heightened risk unless immediate mitigations are applied.
Why This Matters Now
The Fortra GoAnywhere MFT vulnerability represents a critical supply chain and data exfiltration risk for organizations relying on managed file transfer platforms. Its exploitation trend is accelerating, making urgent patching necessary to prevent breaches and regulatory exposure—especially as high-severity vulnerabilities remain a primary target for both ransomware groups and advanced persistent threats.
Attack Path Analysis
Adversaries exploited a critical deserialization vulnerability in Fortra GoAnywhere MFT to gain initial access. Leveraging command execution, they escalated privileges within the environment to obtain greater control. The attacker moved laterally across workloads, possibly accessing adjacent systems or data. Persistent outbound communication with command and control infrastructure enabled remote management of the compromised environment. Sensitive files were likely exfiltrated via covert or direct channels. Ultimately, the incident risked operational disruption, sensitive data exposure, or ransomware deployment impacting business processes.
Kill Chain Progression
Initial Compromise
Description
The threat actor exploited the CVE-2025-10035 deserialization flaw in GoAnywhere MFT's License Servlet to gain unauthorized system access.
Related CVEs
CVE-2025-10035
CVSS 10A deserialization vulnerability in Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Affected Products:
Fortra GoAnywhere MFT – < 7.4.1
Exploit Status:
exploited in the wildCVE-2023-0669
CVSS 7.2Fortra GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Affected Products:
Fortra GoAnywhere MFT – < 7.1.2
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter
Access Token Manipulation
Exploitation for Defense Evasion
Multi-Stage Channels
Exfiltration Over Alternative Protocol
Valid Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security of Public-Facing Applications
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management
Control ID: Article 9
CISA ZTMM 2.0 – Control Public-Facing Service Exposure
Control ID: Access and Application Security
NIS2 Directive – Technical and Organizational Measures
Control ID: Article 21(2)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
GoAnywhere MFT's CVSS 10.0 deserialization vulnerability enables arbitrary command execution, critically threatening secure file transfers and regulatory compliance requirements.
Health Care / Life Sciences
Critical vulnerability in managed file transfer systems poses severe risk to patient data protection and HIPAA compliance infrastructure.
Government Administration
Maximum severity vulnerability exploitation could compromise sensitive government data transfers and critical administrative system security controls.
Banking/Mortgage
Arbitrary command execution vulnerability threatens secure financial data transfers and multi-cloud visibility controls essential for regulatory compliance.
Sources
- Fortra Releases Critical Patch for CVSS 10.0 GoAnywhere MFT Vulnerabilityhttps://thehackernews.com/2025/09/fortra-releases-critical-patch-for-cvss.htmlVerified
- Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- CISA Adds Five Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2025/09/29/cisa-adds-five-known-exploited-vulnerabilities-catalogVerified
- CISA Alert AA23-158A: CL0P Ransomware Gang Exploits MOVEit Vulnerabilityhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158aVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Comprehensive zero trust segmentation, egress policy enforcement, microsegmentation, and real-time threat detection could have prevented or contained the adversary at multiple points—blocking east-west spread, stifling command channels, thwarting data exfiltration, and providing actionable visibility across the kill chain lifecycle.
Control: Inline IPS (Suricata)
Mitigation: Blocks known exploit signatures targeting internet-facing applications.
Control: Threat Detection & Anomaly Response
Mitigation: Detects and alerts on abnormal privilege escalation behavior.
Control: Zero Trust Segmentation
Mitigation: Restricts lateral movement by enforcing least-privilege workload communication.
Control: Egress Security & Policy Enforcement
Mitigation: Blocks unauthorized outbound reach-back or C2 channels.
Control: Encrypted Traffic (HPE) & Egress Security & Policy Enforcement
Mitigation: Detects or blocks exfiltration attempts and ensures sensitive data is protected in transit.
Rapid detection of ransomware-like or destructive activity, enabling incident containment.
Impact at a Glance
Affected Business Functions
- File Transfer Operations
- Data Exchange Services
Estimated downtime: 5 days
Estimated loss: $500,000
Potential exposure of sensitive data transferred through GoAnywhere MFT, including confidential business documents and personal information.
Recommended Actions
Key Takeaways & Next Steps
- • Immediately deploy and verify virtual patching or inline IPS policies for exposed and critical cloud workloads.
- • Implement zero trust segmentation and microsegmentation to restrict east-west communication between sensitive workloads.
- • Enforce strict outbound egress controls, leveraging FQDN and application filtering, to block malicious C2 and data exfiltration attempts.
- • Continuously monitor for anomalies and rapidly investigate and respond to suspicious privilege changes or abnormal workload behavior.
- • Employ high-performance encrypted traffic controls to ensure sensitive data remains protected throughout all network paths.
