Deserialization in GoAnywhere MFT (CVE-2025-10035) — an actor with a validly forged license response signature can have arbitrary objects reconstructed
Fortra GoAnywhere MFT contains a deserialization of untrusted data flaw. An actor holding a validly forged license response signature can deserialize an arbitrary object under their control, possibly leading to command injection. CISA added it to the KEV catalog on 2025-09-29.
Key facts
- CVE IDCVE-2025-10035
- Affected (vendor / product)Fortra GoAnywhere MFT
- CWECWE-502, CWE-77
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2025-10-20 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is Fortra GoAnywhere MFT; CWE-502 (deserialization of untrusted data) and CWE-77 (command injection).
- An actor with a validly forged license response signature can deserialize an arbitrary object under their control.
- The catalog states this may lead to command injection.
- That the precondition sits in the license verification path is distinctive: a place rarely thought of as a security function becomes the entrance.
- Added to KEV 2025-09-29 with a due date of 2025-10-20; ransomware use is known. CWE-502 accounts for 65 of the 1,685 records this site holds as of 2026-08-31.
- By first CWE, CWE-20 leads at 118 while CWE-502 (deserialization) accounts for 65.
1Why deserialization is dangerous
Serialization converts the objects a program works with into flat data for storage or transmission; deserialization reverses it, rebuilding objects from data. During that rebuilding, which type of object to create follows the specification carried in the data. Where an attacker can author that data, objects of unanticipated types can be created, triggering behavior tied to their construction or subsequent handling.
That the record says command injection may follow reflects a path from there to execution.
2The attack starts at license verification
What deserves note is that the precondition given is a validly forged license response signature. Checking a license exists to see whether a product is being used legitimately, and it is rarely thought of as a security function. But the path receiving and processing that response is still a path that interprets data arriving from outside.
If the signature can be forged, it becomes the entrance for having arbitrary data deserialized. It shows that the surface needing protection is decided by where data enters, not by how important a function is.
3CWE-502 appears in 65 of 1,685 records
Classifying the 1,685 KEV records this site holds as of 2026-08-31 by first CWE, CWE-502 (deserialization of untrusted data) accounts for 65. The leaders are CWE-20 (improper input validation) at 118, CWE-78 (OS command injection) at 102, CWE-416 (use-after-free) at 91 and CWE-787 (out-of-bounds write) at 89.
Deserialization is a species of input validation, yet awkward because what needs checking is not the content of the data but the type the data specifies. File transfer products sit where data moves between organizations, so a breach reaches widely.
Why it matters
Paths that interpret incoming data do not line up with how important a function is. License checks and health checks are attack surface too, because they receive and process data. Deserialization cannot be closed by ordinary input validation thinking alone, since what needs checking is the type specified rather than the content.
FAQ
What is deserialization?
Why does a license signature matter?
Why do file transfer products matter more?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).