InfoSecBulletin Cybersecurity for mankind
A critical vulnerability with a perfect 10.0 CVSS score in Fortra’s GoAnywhere Managed File Transfer (MFT) solution was exploited as a zero-day for at least a week before a patch was released.
CVE-2025-10035 is a command injection vulnerability enabling remote code execution without authentication. Security firm watchTowr noted evidence of active exploitation since September 10, 2025, just before Fortra’s advisory on September 18.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
Fortra initially described the vulnerability as a deserialization issue in the GoAnywhere MFT License Servlet. According to the vendor’s advisory, an attacker with a “validly forged license response signature” could deserialize a crafted object, leading to command injection.
Fortra announced on September 18 that an issue was discovered during an internal security check on September 11, but did not mention any active exploitation, which researchers found unusual given the Indicators of Compromise (IoCs) included.
Vulnerability Exploited as 0-Day:
Security researchers have explained the flaw and how it was exploited.
Research from Rapid7 shows that CVE-2025-10035 is a combination of three issues: an access control bypass from 2023, a new unsafe deserialization flaw, and an unknown problem that lets attackers access a certain private key for the exploit.
Threat actors exploited the pre-authentication deserialization vulnerability to achieve Remote Code Execution (RCE).
Attackers created a backdoor admin account called admin-go, which they used to set up a legitimate web user account for MFT service access. They then uploaded and ran multiple secondary payloads through this account.
WatchTowr Labs reported that the exploitation began on September 10, before the patch was released on September 15 and the public advisory on September 18, confirming it as a zero-day vulnerability.
Fortra, a signatory of the Secure By Design pledge, faces criticism for not disclosing active attacks. This left security teams without a complete understanding of the threat timeline for risk assessment.
Indicators of Compromise (IoCs):
Evidence of the in-the-wild attacks includes several key indicators:
Backdoor Account: A local account named admin-go was created on compromised systems.
Malicious Files: Payloads such as C:\Windows\zato_be.exe and
C:\Windows\jwunst.exe (a SimpleHelp binary) were observed.
Attacker IP: The IP address 155.2.190.197 was linked to the threat actor.
Commands Executed: The command whoami /groups was run, with its output saved to C:\Windows\test.txt.
Fortra has released GoAnywhere MFT version 7.8.4 and Sustain version 7.6.3 to address the vulnerability.
Given the history of GoAnywhere MFT being targeted by ransomware groups, organizations are urged to patch immediately and ensure their admin consoles are not exposed to the public internet.
