A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
References
| Link | Resource |
|---|---|
| https://www.fortra.com/security/advisories/product-security/fi-2025-012 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
30 Sep 2025, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:* | |
| References | () https://www.fortra.com/security/advisories/product-security/fi-2025-012 - Vendor Advisory | |
| First Time |
Fortra
Fortra goanywhere Managed File Transfer |
18 Sep 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
18 Sep 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-18 22:15
Updated : 2025-09-30 14:26
NVD link : CVE-2025-10035
Mitre link : CVE-2025-10035
CVE.ORG link : CVE-2025-10035
JSON object : View
Products Affected
fortra
- goanywhere_managed_file_transfer