Article
Remote support and file transfer flaws in ransomware attacks
SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks.
Read more
Exploited vulnerability
GoAnywhere MFT License Servlet flaw (CVE-2025-10035)
CVE-2025-10035
CVE-2025-10035 is a flaw in the License Servlet of Fortra GoAnywhere MFT, a managed file transfer product.
- On CISA KEV
- CVE ID
- CVE-2025-10035
- CISA KEV
- Listed
- Affected product
- GoAnywhere MFT (managed file transfer)
- Exploited
- Yes
- Published
- September 2025
In short
CVE-2025-10035 is a flaw in the License Servlet of Fortra GoAnywhere MFT, a managed file transfer product. Deserialization means the program rebuilds an object from data it was sent. Here an actor with a validly forged license response signature can make the server rebuild an object the actor controls, which may lead to command injection.
- CVECVE-2025-10035
- ProductFortra GoAnywhere MFT (managed file transfer)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade to a fixed release · Detect and hunt
What it allows
An attacker with a validly forged license response signature can have the server run an object of their choice, which can lead to commands on the host. Fortra scores it 10.0 out of 10 (CVSS v3.1), while NVD's own score is 9.8. Fortra says exploitation depends heavily on the system being reachable from the internet.
Who is affected
Fortra says to upgrade to the latest release 7.8.4 or the Sustain Release 7.6.3. NVD lists the affected range as versions before 7.6.3, and 7.7.0 up to before 7.8.4.
Fortra's advisory gives a discovery date of 11 September 2025. NVD published the record on 18 September 2025. CISA added CVE-2025-10035 to its Known Exploited Vulnerabilities (KEV) catalog on 29 September 2025, with a due date of 20 October 2025 for US federal agencies. The KEV entry flags known use in ransomware campaigns.
The Fortra advisory and the other official sources opened here do not give a date for the first exploitation.
Attributed by CISA, FBI and MS-ISAC in the #StopRansomware Medusa advisory (updated 18 August 2026): Medusa actors exploit CVE-2025-10035 in Fortra GoAnywhere.
Who exploits it
What to do
-
Upgrade to a fixed release
Move to GoAnywhere MFT 7.8.4, or to the Sustain Release 7.6.3, as the vendor advises.
-
Close the Admin Console to the internet
Fortra says to ensure at once that access to the GoAnywhere Admin Console is not open to the public. Allow only internal or VPN addresses.
-
Detect and hunt
Fortra advises monitoring Admin Audit logs for suspicious activity. Search the log files for errors containing SignedObject.getObject in a stack trace. Fortra says that if the string is present, the instance was likely affected.
-
Treat a hit as a breach
If the log string is found, review what the transfer server could reach and what ran on the host. Rotate credentials stored in or used by the product.
Questions
What is CVE-2025-10035?
It is a flaw in the License Servlet of Fortra GoAnywhere MFT, a managed file transfer product. An actor with a validly forged license response signature can make the server rebuild an object they control, which may lead to command injection on the host.
Which GoAnywhere MFT versions are affected?
NVD lists versions before 7.6.3, and 7.7.0 up to before 7.8.4. Fortra says to upgrade to the latest release 7.8.4 or the Sustain Release 7.6.3. Fortra also says exploitation depends heavily on the system being reachable from the internet.
How do I check whether CVE-2025-10035 was used against my server?
Fortra advises monitoring Admin Audit logs and searching the log files for errors containing SignedObject.getObject in a stack trace. If the string is present, Fortra says the instance was likely affected. Keep the Admin Console closed to the public internet.
In our research
Sources
- Deserialization Vulnerability in GoAnywhere MFT's License Servlet (FI-2025-012) Fortra
- CVE-2025-10035 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- #StopRansomware: Medusa Ransomware CISA, FBI and MS-ISAC
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.