Critical 1 exploited CVE WID-SEC-2025-2090 1 CVE

Fortra GoAnywhere MFT: Schwachstelle ermöglicht Command Injection

Published Sep 18, 2025 · Updated Sep 25, 2025 · Revision 2 · de-DE

Vendor: Fortra Product: GoAnywhere MFT Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortra GoAnywhere MFT ausnutzen, um Kommandos in der Admin Console auszuführen.

Product

GoAnywhere MFT (Managed File Transfer) ist eine Lösung für den sicheren und effizienten Dateitransfer.

Vulnerabilities 1

Critical 10.0

CVE-2025-10035 Exploited · Ransomware Public exploit Scanner template EPSS 100%

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Fortra GoAnywhere MFT

Sep 18, 2025
KEV Sep 29, 2025

Revision history

2025-09-25 #2
Aktive Ausnutzung gemeldet
2025-09-18 #1
Initiale Fassung

References

Fortra Security Advisory FI-2025-012 vom 2025-09-18
https://www.fortra.com/security/advisories/product-security/fi-2025-012
Watchtowr Vulnerability Research vom 2025-09-25
https://labs.watchtowr.com/it-is-bad-exploitation-of-fortra-goanywhere-mft-cve-2025-10035-part-2/