CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
What It Is – Fortra’s GoAnywhere Managed File Transfer (MFT) product contains a deserialization flaw. An attacker who can present a forged license‑response signature can cause the application to deserialize an arbitrary, attacker‑controlled object. Successful exploitation may lead to command injection on the host system.
Exploitability – No public exploit has been observed, but the vulnerability is exploitable in theory and receives a high CVSS rating (≥7.0) in the NVD.
Affected Products – Fortra GoAnywhere MFT (all supported versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Application security control gap – The issue tests the control objective of validating untrusted data and preventing code injection, a requirement across most governance frameworks (e.g., NIST CSF 2.0 Protect).
- Audit‑ready evidence – Demonstrating that deserialization checks are enforced and logged provides defensible evidence for auditors and regulators.
- Continuous monitoring – Detecting anomalous license‑validation activity requires logging and real‑time monitoring, reinforcing a trustworthy security posture.
Recommended Actions
- Deploy Fortra’s patch for CVE‑2025‑10035 immediately.
- Verify that license‑response handling enforces strict signature verification and input sanitization.
- Update your control inventory to include “secure deserialization” and capture remediation evidence.
- Enable detailed logging of license validation events and monitor for suspicious activity.
Source: CISA KEV – CVE‑2025‑10035