CVE-2025-10035 Fortra GoAnywhere MFT
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
- CVSS
- not scored
On CISA’s exploited list
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
- Added
- 2025-09-29
- Federal patch deadline
- 2025-10-20
- Ransomware use
- known