CVE-2025-10035

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 18, 2026

Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-502

Affected software

VendorProductVersions
FortraGoAnywhere MFT<= 7.8.3

References

Timeline

Published
Sep 18, 2025
Last modified
Oct 18, 2026
Added to CISA KEV
Sep 29, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-100364.9The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up toCVE-2025-100374.9The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() funcCVE-2025-100386.5The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is duCVE-2025-100394.3The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versioCVE-2025-10045.3Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (InCVE-2025-100407.7The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing cCVE-2025-100419.8The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_coCVE-2025-100427.5The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 dueCVE-2025-100444.3A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. ThiCVE-2025-100454.9The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and includCVE-2025-100464.9The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' paraCVE-2025-100474.9The Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerab
CVE-2025-10035: Critical severity, CVSS 9.8 | Vulnix