Overview
In the ever-evolving world of cybersecurity, the discovery of new vulnerabilities is a common occurrence. However, what sets apart the ordinary from the critical is the potential impact and the scale of the affected systems. One such critical vulnerability identified as CVE-2025-10035 affects Fortra’s GoAnywhere Managed File Transfer (MFT) software. This vulnerability is of particular concern due to its high severity score and the possibilities for system compromise and potential data leakage.
GoAnywhere MFT is widely used for secure file transfers, and a vulnerability in this system can have far-reaching implications, potentially affecting thousands of organizations across different sectors. The vulnerability lies in the License Servlet of the software, which could allow an attacker to deserialize an arbitrary object under their control, possibly leading to command injection.
Vulnerability Summary
CVE ID: CVE-2025-10035
Severity: Critical (CVSS:10.0)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise and data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Fortra’s GoAnywhere MFT | All versions prior to the latest patch
How the Exploit Works
The vulnerability exploits the deserialization process in the License Servlet of Fortra’s GoAnywhere MFT. Deserialization is the process of converting a stream of bytes back into a copy of the original object. However, if not properly handled, it can be exploited by attackers to inject malicious payloads into the system.
In the case of CVE-2025-10035, an attacker with a validly forged license response signature can control the deserialization process. This control allows the attacker to inject arbitrary objects, which could potentially lead to command injection, enabling them to execute unauthorized commands or code on the system.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited. This could be a sample HTTP request to the License Servlet with a malicious payload:
POST /LicenseServlet HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "forged_license_signature": "valid_signature",
"malicious_object": "{serialized malicious object}" }In this example, the attacker sends a POST request to the License Servlet with a forged license signature and a serialized malicious object. If the system deserializes this object, it leads to the execution of the attacker’s commands.