CyberSec.Space Logo
Back to CVE Browser

CVE-2025-10035

🔥 Known Exploited (CISA KEV)CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-09-18
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Affected Platforms (CPE)

📦
Fortra

Goanywhere Managed File Transfer

< 7.6.3>= 7.7.0 and < 7.8.4

References & Advisories

🔗 https://www.fortra.com/security/advisories/product-security/fi-2025-012
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035

Related Vulnerabilities

CVE-2026-579174.8

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing th...

CVE-2026-579164.6

proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary ce...

CVE-2026-148566.3

A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, ca...

CVE-2026-400001.8

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files...