CVE-2025-10035 Overview
A critical deserialization vulnerability exists in the License Servlet of Fortra's GoAnywhere Managed File Transfer (MFT) solution. This vulnerability allows an attacker with a validly forged license response signature to deserialize an arbitrary actor-controlled object, potentially leading to command injection and full system compromise.
Critical Impact
This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can achieve remote code execution without authentication, making this a high-priority security issue for organizations using GoAnywhere MFT.
Affected Products
- Fortra GoAnywhere Managed File Transfer (vulnerable versions)
- GoAnywhere MFT License Servlet component
- Organizations using GoAnywhere MFT for secure file transfer operations
Discovery Timeline
- September 18, 2025 - CVE-2025-10035 published to NVD
- October 24, 2025 - Last updated in NVD database
Technical Details for CVE-2025-10035
Vulnerability Analysis
This vulnerability represents a classic insecure deserialization attack chain combined with cryptographic signature forgery. The License Servlet in GoAnywhere MFT processes license response data that includes serialized Java objects. When an attacker can forge a valid signature for the license response, the servlet will deserialize attacker-controlled objects without proper validation.
The attack does not require prior authentication, can be executed remotely over the network, and requires no user interaction—making it particularly dangerous for internet-exposed GoAnywhere MFT instances. Successful exploitation allows attackers to inject and execute arbitrary system commands with the privileges of the GoAnywhere MFT service account.
Root Cause
The root cause of this vulnerability is twofold: insufficient cryptographic validation of license response signatures combined with unsafe deserialization of untrusted data. The License Servlet trusts serialized objects when accompanied by what appears to be a valid signature, without adequately verifying the cryptographic integrity or properly sandboxing the deserialization process.
This follows the CWE-77 (Command Injection) pattern where untrusted input ultimately reaches a system command execution context through the deserialization gadget chain.
Attack Vector
The attack vector is network-based and follows these general phases:
Signature Forgery: The attacker crafts or obtains a validly forged license response signature that the License Servlet will accept as legitimate.
Malicious Object Construction: The attacker constructs a serialized Java object containing a command injection payload, leveraging available deserialization gadget chains within the GoAnywhere MFT classpath.
Payload Delivery: The crafted license response with the forged signature and malicious serialized object is sent to the License Servlet endpoint.
Deserialization and Execution: Upon signature validation, the servlet deserializes the malicious object, triggering the gadget chain and executing the attacker's injected commands.
The vulnerability can be exploited by unauthenticated remote attackers, requiring no user interaction, which significantly increases the risk profile for exposed instances.
Detection Methods for CVE-2025-10035
Indicators of Compromise
- Unusual HTTP requests targeting the GoAnywhere MFT License Servlet endpoint
- Unexpected outbound network connections from GoAnywhere MFT servers
- Anomalous process execution spawned by the GoAnywhere MFT service
- Modified files or new binaries appearing in GoAnywhere MFT installation directories
- Evidence of serialized Java object payloads in web server logs
Detection Strategies
- Monitor web application logs for suspicious requests to license-related endpoints with unusual or oversized payloads
- Implement network-based detection rules for known Java deserialization attack patterns
- Deploy endpoint detection and response (EDR) solutions to identify anomalous process chains originating from the GoAnywhere MFT process
- Review authentication logs for unauthorized access attempts preceding exploitation
Monitoring Recommendations
- Enable verbose logging on GoAnywhere MFT License Servlet components
- Configure SIEM alerts for command execution anomalies from GoAnywhere MFT service accounts
- Implement file integrity monitoring on GoAnywhere MFT installation directories
- Monitor for lateral movement indicators following potential compromise
How to Mitigate CVE-2025-10035
Immediate Actions Required
- Apply the security patch from Fortra immediately as this vulnerability is actively exploited
- Restrict network access to GoAnywhere MFT administrative interfaces to trusted networks only
- Audit all GoAnywhere MFT instances for signs of compromise before and after patching
- Consider temporarily taking vulnerable instances offline if immediate patching is not possible
- Review and rotate any credentials that may have been exposed on compromised systems
Patch Information
Fortra has released a security patch addressing this vulnerability. Organizations should consult the Fortra Security Advisory FI-2025-012 for specific patch versions and upgrade instructions. Given that this vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, federal agencies and organizations following CISA guidance should prioritize remediation according to the specified deadline.
Workarounds
- Implement network segmentation to limit access to GoAnywhere MFT servers from untrusted networks
- Deploy a web application firewall (WAF) with rules to detect and block serialized Java object payloads
- Disable or restrict access to the License Servlet if not operationally required
- Apply IP allowlisting to limit connections to known administrative hosts only
- Monitor for exploitation attempts while awaiting patch deployment
# Network segmentation example - restrict License Servlet access
# Add firewall rules to limit access to GoAnywhere MFT ports
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
# Verify GoAnywhere MFT service is running with least privilege
ps aux | grep -i goanywhere
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
