CVE-2025-10035

The attacker forges the license response signature in such a way that it passes server-side verification. The crafted response contains a maliciously constructed serialized object that the License Servlet deserializes without proper content validation (CWE-502). The deserialization operation leads to command injection (CWE-77), enabling execution of arbitrary system commands in the context of the application server. The vulnerability requires no authentication or user interaction, and its scope of impact extends beyond the application itself (Scope: Changed).

An attacker can gain full control over the server — execute arbitrary operating system commands, access stored files and data (including those transferred via MFT), and compromise the integrity and availability of the system.

Security patches available from the vendor must be applied immediately in accordance with the official Fortra advisory (fi-2025-012). Due to confirmed active exploitation by CISA KEV, the update should be treated as a priority. Until the patch is deployed, consider restricting network access to the License Servlet and monitoring anomalous requests directed to this component.

Fortra GoAnywhere Managed File Transfer — versions indicated in vendor references (advisory fi-2025-012 on fortra.com).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.