GoAnywhere MFT exploitation after CVE-2025-10035

**Fortra GoAnywhere MFT** vulnerability **CVE-2025-10035** is a **critical deserialization flaw** in the **License Servlet** that can lead to **command injection** and is assessed as **actively exploited since at least September 11, 2025**. **Fortra** said the risk is limited to systems with the **Admin Console exposed to the public internet**, notified affected on-premises customers and **law enforcement**, and released fixes in **September 2025**. **Microsoft** linked exploitation to **Storm-1175** and said the flaw was used to deploy **Medusa ransomware**.

**CVE-2025-10035** in **Fortra GoAnywhere Managed File Transfer (MFT)** is being **actively exploited** in **ransomware attacks** against systems with the **admin console exposed to the public internet**. **Fortra** said the flaw is a **critical deserialization vulnerability** in the **License Servlet** and confirmed **unauthorized activity** tied to the issue, while **Microsoft** linked the abuse to **Storm-1175** and **Medusa ransomware**. The vendor investigated starting **September 11, 2025**, notified affected on-premises customers and law enforcement, and released a **hotfix on September 12** followed by full patched versions on **September 15**.

**Storm-1175** is running a **high-tempo Medusa ransomware campaign** that has repeatedly exploited **n-day and zero-day flaws** to gain initial access before patching closes the window. Microsoft tied the group to **CVE-2025-10035** in **Fortra GoAnywhere MFT**, a **critical deserialization bug** that can enable **unauthenticated command injection** and potential **RCE**, with activity observed since **September 10-11, 2025**. The campaign has affected **healthcare**, **education**, **professional services**, and **finance** organizations in **Australia**, the **UK**, and the **US**, and post-exploitation activity has included **SimpleHelp**, **MeshAgent**, **mstsc.exe**, **Rclone**, and **Cloudflare tunnel** usage.

**Storm-1175** is running a **high-velocity exploit campaign** that rapidly turns access into **Medusa ransomware** deployment, creating risk of **data exfiltration** and encrypted outages. The group is now tied to **CVE-2025-10035** in **Fortra GoAnywhere Managed File Transfer (MFT)**, a **critical deserialization flaw** with **CVSS 10.0** that Microsoft says is being **actively exploited** in ransomware attacks. Microsoft says **Storm-1175** first used the flaw as a **zero day** on **September 11**, and Fortra patched it on **September 18**. Post-exploitation activity included **SimpleHelp**, **MeshAgent**, **mstsc.exe**, **Rclone**, lateral movement, and a **Cloudflare tunnel** for command-and-control.

**CVE-2025-10035** in **Fortra GoAnywhere Managed File Transfer (MFT)** is a **critical deserialization flaw** in the **License Servlet** that can enable **unauthenticated command injection** on systems with an **admin console exposed to the public internet**. Fortra said it found potentially suspicious activity after a report on **September 11, 2025**, notified affected on-premises customers and law enforcement, and released a **hotfix** for **7.6.x, 7.7.x, and 7.8.x** the next day, followed by full patched releases **7.6.3** and **7.8.4** on **September 15**. Fortra also said it has received a **limited number of reports** of unauthorized activity, while Microsoft tied exploitation to **Storm-1175** and **Medusa ransomware**.