GoAnywhere MFT License Servlet Deserialization RCE (2025)
- Product
- Fortra GoAnywhere MFT
- CVE
- CVE-2025-10035
- Disclosed
- 2025-09-18
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- GoAnywhere MFT up to 7.8.3 (and Sustain releases before 7.6.3).
- Fixed
- 7.8.4; Sustain release 7.6.3.
Summary
Another deserialization bug in the GoAnywhere License Servlet allowed command injection by an attacker with a validly forged license response. Microsoft attributed in-the-wild exploitation to Storm-1175, which deployed Medusa ransomware.
Root cause
The License Servlet deserializes a signed license response object. Weaknesses in how the signature and request flow are validated let an attacker supply attacker-controlled serialized data that reaches a deserialization sink, leading to code execution.
Impact
Unauthenticated code execution on the MFT server, used for ransomware deployment.
Detection
Search logs for 'SignedObject.getObject' errors referencing the License Servlet. Version-check against 7.8.4.
Mitigation
Upgrade and keep the admin console off the internet.