{"id":76137,"date":"2025-09-25T11:16:03","date_gmt":"2025-09-25T11:16:03","guid":{"rendered":""},"modified":"2025-09-28T03:05:36","modified_gmt":"2025-09-28T09:05:36","slug":"cve-2025-10035-critical-deserialization-vulnerability-in-fortra-s-goanywhere-mft","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-10035-critical-deserialization-vulnerability-in-fortra-s-goanywhere-mft\/","title":{"rendered":"CVE-2025-10035: Critical Deserialization Vulnerability in Fortra’s GoAnywhere MFT<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In the ever-evolving world of cybersecurity, the discovery of new vulnerabilities is a common occurrence. However, what sets apart the ordinary from the critical is the potential impact and the scale of the affected systems. One such critical vulnerability<\/a> identified as CVE-2025-10035 affects Fortra’s GoAnywhere Managed File Transfer (MFT) software. This vulnerability is of particular concern due to its high severity<\/a> score and the possibilities for system compromise and potential data leakage.
\nGoAnywhere MFT is widely used for secure file transfers, and a vulnerability in this system<\/a> can have far-reaching implications, potentially affecting thousands of organizations across different sectors. The vulnerability lies in the License Servlet of the software, which could allow an attacker to deserialize an arbitrary<\/a> object under their control, possibly leading to command injection.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-10035
\nSeverity: Critical (CVSS:10.0)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system<\/a> compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n