CWE-502

Fortra patches critical GoAnywhere MFT flaw; admins urged to restrict internet exposure of Admin Console

News, Risk, Vendors, Vulnerabilities

September 19, 2025

Fortra has issued patches for a critical GoAnywhere MFT vulnerability (CVE-2025-10035) that could enable remote command injection via deserialization. The company urges administrators to secure Admin Console access and apply the latest updates, as Shadowserver tracks hundreds of GoAnywhere instances and exposure continues to be a concern.