A Vulnerability in GoAnywhere Managed File Transfer (MFT) Could Allow for Command Injection

A deserialization vulnerability (CVE-2025-10035) in Fortra's GoAnywhere MFT License Servlet can allow an attacker with a validly forged license response signature to deserialize actor-controlled objects and potentially achieve command injection; exploitation requires the Admin Console to be publicly accessible, so Fortra recommends ensuring it is not exposed to the internet.