Researchers raise alarm over maximum-severity defect in GoAnywhere file-transfer service

A critical deserialization vulnerability (CVE-2025-10035, CVSS 10) was disclosed in Fortra's GoAnywhere MFT that enables unauthenticated deserialization of attacker-controlled objects and potential command injection; Fortra released a patch and mitigation guidance. Researchers note the flaw is nearly identical to a 2023 zero-day abused by Clop and, while no public exploitation has been observed yet, security firms warn widespread exploitation by ransomware groups is likely given the product's broad use.