Request a Demo

CVE-2025-10035

Critical

Emerging Threat · 19 Sep 2025

Rapidly Respond To CVE-⁠2025-⁠10035

At a glance

  • Deserialization flaw (CWE-502) in the GoAnywhere MFT License Servlet, reachable pre-auth; versions before 7.8.4 and 7.6.3 Sustain
  • CVSS v3.1 10.0 (Fortra) and 9.8 (NVD): Critical
  • Exploited in the wild from 10 Sep 2025 per watchTowr Labs evidence, before disclosure; added to CISA KEV on 29 Sep 2025
  • Fixed in GoAnywhere MFT 7.8.4 and Sustain Release 7.6.3; Fortra advisory FI-2025-012 published 18 Sep 2025
  • Public analysis and proof-of-concept detail from watchTowr Labs on 24 Sep 2025

We can rapidly deploy the zero-install watchTowr Platform to determine whether your organization is affected — including instances that were never on your asset inventory.

CVSS

10.0 (v3.1)

Exploitation

In The Wild

CISA KEV

Listed

Vendor patch

Available

watchTowr check

Live

Rapid support

Find Out If You’re Affected

We onboard from outside, assess your exposure to this CVE, and come back with a validated answer, not a maybe.

Zero install · no infrastructure changes

Deployed and assessing within hours

How we answer it

Hour 0

You give us a domain. Nothing to install, no infrastructure change.

Hours

We reconstruct your external estate and locate every exposed instance an attacker could reach.

Same Day

You get a validated answer on exposure, and mitigation options if you cannot patch immediately.

What Teams Ask Us First?

GoAnywhere MFT below 7.6.3 (Sustain) or from 7.7.0 up to 7.8.3 is affected; the License Servlet sits behind the admin console, so instances whose admin console is exposed to the internet are at most risk. Check the installed version and whether the /goanywhere/ admin paths are reachable externally.
Yes. watchTowr Labs reported credible evidence of in-the-wild exploitation dating back to 10 September 2025, eight days before Fortra’s advisory, with attackers creating a backdoor administrator account named admin-go, and CISA added CVE-2025-10035 to its KEV catalog on 29 September 2025 with known ransomware use.
Upgrade to GoAnywhere MFT 7.8.4 or Sustain Release 7.6.3, remove public exposure of the admin console, and review Admin Users and logs for unknown accounts such as admin-go or unexpected executables in the Windows directory. watchTowr can validate your exposure from outside, with nothing to install.
Attackers Don't Give Up. Neither Should Your Security Testing.

Zero install. No infrastructure changes. Uplift your security posture within hours of onboarding the watchTowr Platform.

Get Continuous Testing
Talk to our team
PHP2Shell Remote Code Execution FAQ

Frequently asked questions about PHP2Shell CVE-2026-109618 and CVE-2026-109619

Read The FAQ
Find Out What an Attacker Can Reach Before They Do.

Point us at a domain. We reconstruct your real external estate and come back with validated exposure, not a theoretical CVE list.

Request a Demo
See the Platform
Disclosure to Exploitation Is Four Hours. Patching Is Not.

The watchTowr Platform validates your exposure to an emerging threat and mitigates it at the edge while the vendor patch is still in testing.

Get Continuous Testing
How the Platform works
We Find the Vulnerabilities. You Hear It From Us First.

watchTowr Labs publishes what is being exploited right now and whether it touches your estate, not vendor summaries written a week late.

Read the Research
Talk to our team
Your Exposure Changes Weekly. Annual Testing Cannot Describe It.

Continuous, fully external validation of what an attacker can actually exploit against your estate, at a 0.01% false-positive rate.

Get Continuous Testing
Read the case studies
See the Estate You Own, Including What No Asset List Holds.

Subsidiaries, forgotten infrastructure, shadow IT. We rebuild your external surface from a single domain, then validate what is exposed.

Request a Demo
Explore use cases