[critical] Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

Mon, 29 Sep 2025 00:00:00 GMT

Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-29: CISA added CVE-2025-10035 to the KEV catalog (due 2025-10-20).

CVEs: CVE-2025-10035

[high] Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims

Fri, 10 Feb 2023 00:00:00 GMT

A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.

Status: closed · Patch: patched · Fixed in: 7.1.2

Latest updates:

2023-02-10: CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations (source)
2023-02-07: Emergency patch: GoAnywhere MFT 7.1.2 (source)
2023-02-01: Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console (source)

CVEs: CVE-2023-0669

pwn.watch: GoAnywhere incident updates

[critical] Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

[high] Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims