CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-09-29. EPSS: 99.8% chance of exploitation in the next 30 days.

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Affected products

• Fortra GoAnywhere Managed File Transfer: before 7.6.3 (fixed in 7.6.3); from 7.7.0, before 7.8.4 (fixed in 7.8.4)

Published 2025-09-18. Last modified 2026-08-04.