THREAT OPS › Threat News › [NVD] CVE-2025-10035 (CRITICAL 10.0) — A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
[NVD] CVE-2025-10035 (CRITICAL 10.0) — A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CVE-2025-10035 CVSS: 10.0 CRITICAL Published: 2025-09-18T22:15:41.857
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Indicators of compromise
- CVE-2025-10035cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-10035