FORTRA ADDRESSED A MAXIMUM SEVERITY FLAW IN GOANYWHERE MFT SOFTWARE

Summary from the TLDR InfoSec newsletter

Fortra has patched a critical deserialization vulnerability (CVE-2025-10035) with a maximum CVSS score of 10.0 in the GoAnywhere Managed File Transfer software that allows attackers to execute arbitrary commands through the License Servlet. The company has urged customers to upgrade to version 7.8.4 or sustaining release 7.6.3 and recommends restricting public access to the GoAnywhere Admin Console to mitigate exploitation risks. This follows previous high-severity vulnerabilities in the same product, including an authentication bypass flaw (CVE-2024-0204) discovered in January 2024.