Actively Exploited GoAnywhere MFT Zero- Day Vulnerability (CVE-2025-10035)

THE THREAT

On September 25th, 2025, watchTowr Labs revealed that a recently disclosed vulnerability in Fortra's GoAnywhere Managed File Transfer (MFT), identified as CVE-2025-10035 (CVSS: 10), had been exploited in the wild prior to its official disclosure. Fortra initially disclosed CVE-2025-10035 on September 18th, 2025, and provided patches to mitigate the flaw. CVE-2025-10035 is a critical deserialization vulnerability in the License Servlet of GoAnywhere MFT. It allows an attacker to use a validly forged license response signature to deserialize an arbitrary, attacker-controlled object, potentially leading to command injection.

On September 24th, 2025, watchTowr Labs published a detailed Proof-of-Concept (PoC) exploit code for CVE-2025-10035. The firm confirmed its active exploitation had occurred as early as September 10th, 2025, the following day, thereby rendering it as a zero-day vulnerability.

Fortra has noted that exploitation of CVE-2025-10035 depends on systems being exposed to the Internet. Given the confirmed exploitation, any Internet-facing, unpatched instances of GoAnywhere MFT are at high risk and remain vulnerable. As the vulnerability poses a significant threat by enabling authentication bypass to inject commands, which could ultimately lead to the complete compromise of the affected system, organizations are recommended to apply relevant security patches immediately.

What we're doing about it

• eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-10035
• eSentire Threat Response Unit (TRU) is conducting threat hunting using the provided Indicators of Compromise (IoCs)
• Known malicious IPs have been added to eSentire's Global Block List
• eSentire's MDR for Network has detections in place to identify CVE-2025-10035 exploitation activity
• eSentire's Threat Response Unit (TRU) is actively tracking this topic for additional detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches released by Fortra
  • GoAnywhere MFT version 7.8.4, or the Sustain Release 7.6.3
• Restrict external access to GoAnywhere MFT's Admin Console

Additional information

Within their follow-up report on September 25th, 2025, watchTowr Labs noted that Fortra indicated to CyberScoop that the vulnerability was initially discovered during a "security check" on September 11th, 2025, claiming that this statement could be interpreted as the vulnerability being initially discovered internally. However, watchTowr Labs states that they have received "credible evidence" indicating that the vulnerability had been exploited in the wild as early as September 10th, eight days prior to Fortra's disclosure and patch release, making it a zero-day vulnerability. watchTowr Labs highlights that based on observed exploitation, the "Am I Impacted?" section of Fortna's advisory was actually sharing IoCs for impacted devices.

watchTowr Labs provides details on the reported attacks, which involved threat actors exploiting CVE-2025-10035 to achieve Remote Code Execution (RCE) to create a backdoor administrator account named 'admin-go'. This account was used to create a web user, providing legitimate access to the solution, and enabled the threat actor to upload and execute secondary payloads. No attribution to a specific threat actor, or any motivation behind the attacks, was provided. Along with watchTowr Labs publishing PoC exploit code for the vulnerability, Rapid7 also published a technical report of the vulnerability on September 24th.

Vulnerabilities impacting GoAnywhere MFT have a history of being targeted by threat actors, with an example being the zero-day vulnerability CVE-2023-0669. In February 2023, the Cl0p ransomware group targeted exposed GoAnywhere MFT Admin Consoles vulnerable to CVE-2023-0669, with the attacks resulting in the deployment of Cl0p ransomware and data extortion. Given that PoC exploit code for the vulnerability is publicly available, reports that the vulnerability was observed being exploited in the wild, and historic trends targeting GoAnywhere MFT vulnerabilities, eSentire's Threat Intelligence team assesses that widespread exploitation of the vulnerability will likely be observed in the near future. As such, organizations are urged to apply relevant security patches and mitigation steps as soon as possible.

References:

[1] https://labs.watchtowr.com/it-is-bad-exploitation-of-fortra-goanywhere-mft-cve-2025-10035-part-2/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-10035
[3] https://www.fortra.com/security/advisories/product-security/fi-2025-012
[4] https://labs.watchtowr.com/is-this-bad-this-feels-bad-goanywhere-cve-2025-10035/
[5] https://www.goanywhere.com/blog/10-essential-tips-for-securing-ftp-and-sftp-servers
[6] https://cyberscoop.com/goanywhere-file-transfer-service-vulnerability-september-2025/
[7] https://attackerkb.com/topics/LbA9ANjcdz/cve-2025-10035/rapid7-analysis
[8] https://nvd.nist.gov/vuln/detail/cve-2023-0669
[9] https://hivepro.com/threat-advisory/clop-ransomware-group-claims-responsibility-for-goanywhere-mft-attacks/