Description
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CISA Known Exploited Vulnerability
Date added 2025-09-29 | Due date 2025-10-20
Known Ransomware Campaign(s)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Problem types
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-502 Deserialization of Untrusted Data
Product status
Any version
References
www.cisa.gov/...erabilities-catalog?field_cve=CVE-2025-10035
www.fortra.com/...ty/advisories/product-security/fi-2025-012
