A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT

CVE-2025-10035 is a deserialization-to-command-injection chain in the License Servlet of Fortra GoAnywhere MFT — a managed file transfer gateway that enterprises deploy in the DMZ specifically to move sensitive data between business partners. All versions prior to 7.8.4 (standard release) and 7.6.3 (sustain release) are affected. The chain combines three issues: an authentication bypass on the License Servlet endpoint (known since 2023), hard-coded encryption keys that let an attacker recover session tokens offline, and the unsafe deserialization of attacker-controlled Java objects inside a SignedObject wrapper. The net result is unauthenticated remote code execution — full SYSTEM-level compromise of the MFT host from the internet.

Fortra rated this CVSS 10.0/CRITICAL, and for once the vendor score is exactly right. GoAnywhere MFT is *designed* to be internet-facing; its entire purpose is external file exchange. The auth bypass requires a single crafted GET request. The hard-coded keys are identical across all installations. Microsoft confirmed Storm-1175 was exploiting this as a zero-day starting September 10, 2025 — a full week before Fortra disclosed it on September 18 — dropping SimpleHelp and MeshAgent persistence tools and deploying Medusa ransomware within 24 hours of initial access. watchTowr Labs published a full PoC on September 24. CISA added it to KEV on September 29. The EPSS score of 0.998 puts it in the top 0.2% of all CVEs for exploitation probability. There is no legitimate reason to disagree with the vendor here.

1. Restrict admin console and License Servlet to internal/VPN-only access immediately — The entire attack chain requires network reachability to the GoAnywhere admin port (typically 8000/8001). Blocking internet access to these ports via firewall rules eliminates the unauthenticated attack vector. Deploy within hours — this is your noisgate mitigation SLA for CRITICAL: ≤ 3 days, but given active exploitation and KEV listing, treat this as an emergency change within hours. If the admin console must remain accessible, restrict it to known management IPs via allowlist.
2. Upgrade to GoAnywhere MFT 7.8.4 or sustain release 7.6.3 — The vendor patch hardens the deserialization routine with type restrictions. This is the definitive fix. Deploy within the noisgate remediation SLA of ≤ 90 days, but given active ransomware exploitation, prioritize emergency patching within days, not weeks. Test in a staging environment first if possible, but do not let testing delay deployment beyond 72 hours.
3. Deploy EDR or endpoint monitoring on GoAnywhere MFT hosts — Many MFT appliances run without endpoint agents, leaving post-exploitation activity invisible. Install EDR capable of detecting: RMM tool installation (SimpleHelp, MeshAgent), unexpected child process spawning from the Java/GoAnywhere process, and .jsp file creation in web directories. This provides detection-in-depth if the network control fails.
4. Audit GoAnywhere host for IOCs published by Microsoft and Fortra — Check for: unexpected .jsp files in GoAnywhere web directories, SimpleHelp or MeshAgent binaries, unusual outbound connections to C2 infrastructure, and new local accounts. Microsoft's October 6 blog contains specific file hashes and C2 domains. If any IOCs are found, treat the host and all credentials it holds as compromised.
5. Rotate all credentials stored on or accessible from the MFT host — GoAnywhere MFT hosts typically store AD service account credentials, SFTP partner keys, database connection strings, and LDAP bind credentials. If exploitation cannot be ruled out, rotate these credentials immediately. The MFT host's DMZ position means a compromise exposes every system it connects to.
6. Implement network segmentation between DMZ MFT hosts and internal LAN — Even if the MFT host is compromised, strict firewall rules limiting its internal connectivity to only required file share and database ports will slow lateral movement. Block all outbound RDP, SMB, and WMI from the MFT host to internal subnets except explicitly required destinations.

Run this script on each GoAnywhere MFT host (Linux/Windows via bash or WSL) as any user with read access to the GoAnywhere installation directory. Example: bash check_cve_2025_10035.sh /opt/GoAnywhere. The script checks the installed version against the patched versions and probes the License Servlet endpoint for the auth bypass indicator.

#!/usr/bin/env bash
# CVE-2025-10035 Verification Script for GoAnywhere MFT
# Usage: bash check_cve_2025_10035.sh [GOANYWHERE_INSTALL_DIR] [OPTIONAL_URL]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

GA_DIR="${1:-/opt/GoAnywhere}"
GA_URL="${2:-}"
STATUS="UNKNOWN"

echo "=== CVE-2025-10035 Check ==="
echo "GoAnywhere directory: $GA_DIR"

# Method 1: Version file check
if [ -f "$GA_DIR/version.txt" ]; then
  VERSION=$(cat "$GA_DIR/version.txt" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
  echo "Detected version: $VERSION"
  if [ -n "$VERSION" ]; then
    MAJOR=$(echo "$VERSION" | cut -d. -f1)
    MINOR=$(echo "$VERSION" | cut -d. -f2)
    PATCH=$(echo "$VERSION" | cut -d. -f3)
    # Fixed in 7.8.4 (standard) or 7.6.3 (sustain)
    if [ "$MAJOR" -gt 7 ]; then
      STATUS="PATCHED"
    elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -gt 8 ]; then
      STATUS="PATCHED"
    elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 8 ] && [ "$PATCH" -ge 4 ]; then
      STATUS="PATCHED"
    elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 6 ] && [ "$PATCH" -ge 3 ]; then
      STATUS="PATCHED"
    else
      STATUS="VULNERABLE"
    fi
  fi
elif [ -f "$GA_DIR/build.properties" ]; then
  VERSION=$(grep -oP 'version=\K[0-9]+\.[0-9]+\.[0-9]+' "$GA_DIR/build.properties" 2>/dev/null || true)
  echo "Detected version from build.properties: ${VERSION:-not found}"
  if [ -n "$VERSION" ]; then
    MAJOR=$(echo "$VERSION" | cut -d. -f1)
    MINOR=$(echo "$VERSION" | cut -d. -f2)
    PATCH=$(echo "$VERSION" | cut -d. -f3)
    if [ "$MAJOR" -gt 7 ]; then
      STATUS="PATCHED"
    elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -gt 8 ]; then
      STATUS="PATCHED"
    elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 8 ] && [ "$PATCH" -ge 4 ]; then
      STATUS="PATCHED"
    elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 6 ] && [ "$PATCH" -ge 3 ]; then
      STATUS="PATCHED"
    else
      STATUS="VULNERABLE"
    fi
  fi
else
  echo "WARNING: Could not find version file at $GA_DIR"
fi

# Method 2: HTTP endpoint probe (optional)
if [ -n "$GA_URL" ]; then
  echo "Probing endpoint: $GA_URL"
  PROBE_URL="${GA_URL}/goanywhere/license/Unlicensed.xhtml/noisgate_check?javax.faces.ViewState=noisgate&GARequestAction=activate"
  HTTP_RESP=$(curl -sk -o /dev/null -w '%{http_code}:%{redirect_url}' -L --max-redirs 0 "$PROBE_URL" 2>/dev/null || echo "000:")
  HTTP_CODE=$(echo "$HTTP_RESP" | cut -d: -f1)
  REDIRECT_URL=$(echo "$HTTP_RESP" | cut -d: -f2-)
  echo "HTTP response code: $HTTP_CODE"
  if echo "$REDIRECT_URL" | grep -q 'bundle='; then
    echo "RESULT: Redirect contains bundle parameter - VULNERABLE"
    STATUS="VULNERABLE"
  elif [ "$HTTP_CODE" = "302" ] || [ "$HTTP_CODE" = "301" ]; then
    if ! echo "$REDIRECT_URL" | grep -q 'bundle='; then
      echo "RESULT: Redirect without bundle parameter - likely PATCHED"
      if [ "$STATUS" = "UNKNOWN" ]; then STATUS="PATCHED"; fi
    fi
  elif [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "404" ]; then
    echo "RESULT: Endpoint blocked or not found - likely mitigated"
    if [ "$STATUS" = "UNKNOWN" ]; then STATUS="PATCHED"; fi
  else
    echo "RESULT: Inconclusive HTTP response"
  fi
fi

echo ""
echo "=== VERDICT: $STATUS ==="

case "$STATUS" in
  VULNERABLE) exit 1 ;;
  PATCHED)    exit 0 ;;
  *)          exit 2 ;;
esac

1. Fortra Security Advisory FI-2025-012
2. Rapid7 ETR: Critical Unauthenticated RCE in GoAnywhere MFT
3. watchTowr Labs: Is This Bad? This Feels Bad (GoAnywhere CVE-2025-10035)
4. Microsoft Security Blog: Investigating Active Exploitation of CVE-2025-10035
5. Censys Advisory: CVE-2025-10035 Exposure Data
6. Bitsight: Critical Vulnerability Alert CVE-2025-10035
7. The Hacker News: Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day
8. GitHub Advisory GHSA-fcfw-g3g2-2588