Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2025-10035

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Fortra

Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortra GoAnywhere MFT

Default version status: affected

  • 0 to ≤ 7.8.3affected

References