CVE · Exploited · On CISA KEV

CVE-2025-10035

Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

9.8: CVSS 3.1
1: story
SEP 29: added to KEV

Severity: 9.8 Critical · NVD score
Vendor: Fortra
Product: GoAnywhere MFT
Published: Sep 18, 2025
Added to KEV: Sep 29, 2025
KEV deadline: Oct 20, 2025
Ransomware use: Known
Weakness: CWE-77, CWE-502

What it is

Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

OCT 7
VulnerabilitiesAttackers Exploit Critical GoAnywhere Bug to Spread Medusa RansomwareA critical GoAnywhere flaw (CVE-2025-10035) is being targeted in attacks by a threat group known for deploying Medusa ransomware.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryfortra.com/security/advisories/product-security/fi-2025-012