Fortra GoAnywhere MFT, deserialization RCE (License Servlet)
A deserialization vulnerability in the License Servlet of Fortra GoAnywhere MFT allows an attacker who can present a forged, validly-signed license response to deserialize an arbitrary attacker-controlled object, leading to command injection and unauthenticated remote code execution. It was exploited in the wild as a zero-day, including Medusa ransomware deployment.
Overview
CVE-2025-10035 is a maximum-severity (CVSS 10.0) deserialization vulnerability in the License Servlet of Fortra GoAnywhere MFT, a widely deployed managed file-transfer product. An attacker able to present a forged license response with a valid signature can force the server to deserialize an arbitrary object, leading to command injection and remote code execution. It was exploited as a zero-day roughly a week before public disclosure and tied to Medusa ransomware deployment by the actor Microsoft tracks as Storm-1175. (NVD's secondary score is 9.8 with an unchanged scope; Fortra's CNA score is 10.0.)
Technical Details
The License Servlet accepts a license response and validates its signature before deserializing the embedded object. The flaw lets an attacker who can satisfy the signature check supply a malicious serialized object, which GoAnywhere deserializes into a gadget chain that injects operating-system commands. Public reporting indicates the practical prerequisite (a forged but valid signature) was achievable in real attacks, making exploitation effectively unauthenticated against exposed admin consoles.
Impact
- Remote code execution on the GoAnywhere server, often internet-facing for partner file exchange.
- Ransomware deployment: Storm-1175 used access to deploy Medusa ransomware and exfiltrate data.
- Sensitive data exposure: MFT systems broker high-value files between organizations.
- Echoes the 2023 GoAnywhere (CVE-2023-0669) and MOVEit mass-exploitation patterns, raising urgency.
Mitigation
- Upgrade immediately to GoAnywhere MFT 7.8.4, or to the 7.6.3 Sustain Release for the 7.6.x branch.
- Do not expose the GoAnywhere admin console to the internet; restrict it to trusted networks/VPN.
- Review the Admin Audit log for unexpected admin actions and the appearance of new admin users.
- Rotate credentials and signing material and assume data accessed before patching may be compromised.
Detection
- Inspect GoAnywhere logs for
SignedObject.getObjectdeserialization errors / stack traces - a documented exploitation artifact. - Hunt for unexpected child processes spawned by the GoAnywhere Java process and newly created admin accounts.
- Match against Microsoft and Fortra IOCs; CISA added the CVE to KEV on September 29, 2025.