Critical GoAnywhere MFT Vulnerability (CVE‑2025‑10035): Stopping Command Injection Attacks

Critical GoAnywhere MFT Vulnerability (CVE‑2025‑10035): Stopping Command Injection Attacks

Fortra’s GoAnywhere Managed File Transfer (MFT) platform recently received a critical security alert for CVE-2025-10035. The vulnerability resides in the product’s License Servlet, where unsafe deserialization of a forged license response signature lets an attacker deserialize an arbitrary object and trigger command injection. With a CVSS score of 10.0, this bug allows remote unauthenticated attackers to execute arbitrary commands on the MFT server, potentially leading to full system compromise and theft of data in transit.

Threat actors, including the Storm-1175 group, have already weaponized this exploit to deploy ransomware and create backdoor admin accounts. Because GoAnywhere MFT is commonly used to transfer sensitive files such as medical records and financial statements, its compromise could expose regulated data and disrupt business operations. This vulnerability highlights how attackers are chaining zero-day exploits with social engineering; the global average cost of a breach climbed to $4.88 million in 2025, and ransomware crews aren’t slowing down.

To defend against CVE-2025-10035, organizations should:

- Apply the vendor’s hotfix and upgrade to the latest version; Fortra has released patches to address the issue. Delay in patching leaves your environment at risk, and attackers may exploit out-of-date components.
- Restrict access to the license administration console; place it behind VPNs or jump hosts and enforce strong authentication.
- Disable the License Servlet if not needed and review custom license code for misconfiguration or unauthorized modifications.
- Monitor logs and intrusion detection systems for signs of exploitation, such as unusual user creation or suspicious commands.
- Rotate credentials and review access controls on the MFT server regularly.

Terra System Labs can help you assess exposure and implement mitigations. Our experts provide penetration testing, secure configuration reviews, and incident response planning for managed file transfer systems. We also deliver security awareness training so employees can recognize phishing attempts that often precede zero‑day exploitation. Don’t wait for attackers to exploit this vulnerability – secure your file transfer infrastructure today.