Hackers are actively exploiting a maximum severity vulnerability (CVE-2025-10035) in Fortra's GoAnywhere MFT that allows injecting commands remotely without authentication.
The vendor disclosed the flaw on September 18, buit the company had learned about it a week earlier, and did not share any details on how it was discovered or if it was being exploited.
CVE-2025-10035 is a deserialization vulnerability in the License Servlet of the GoAnywhere managed file transfer software that can be leveraged to inject commands by "an actor with a validly forged license response signature."
Although Fortra's advisory hasn't been updated to include any information about the vulnerabililty being used in attacks, security researchers at WatchTowr Labs say that they received "credible evidence" of Fortra GoAnywhere CVE-2025-10035 being leveraged as a zero day.
"We have been given credible evidence of in-the-wild exploitation of Fortra GoAnywhere CVE-2025-10035 dating back to September 10, 2025," reads WatchTowr's report.
"That is eight days before Fortra's public advisory, published September 18, 2025," the researchers point out.
"This explains why Fortra later decided to publish limited IOCs, and we're now urging defenders to immediately change how they think about timelines and risk."
WatchTowr confirmed that the analyzed data contains the stack trace related to exploitation and the creatiuon of a backdoor account:
achieving remote command execution after exploiting the pre-auth deserialization vulnerability creating a backdoor admin account called admin-go using the account to create a web user that enabled "legitimate" access uploading and executing multiple secondary payloads
From the indicators of compromise WatchTowr published at the bottom of the report, the payloads are named 'zato_be.exe' and 'jwunst.exe.'
The latter is a a legitimate binary for the remote access product SimpleHelp. In this case, it is being abused for persistent hands-on control of the compromised endpoints.
The researchers also note that the attackers executed the 'whoami/groups' command, which prints the current user account and Windows group memberships, and saved the output to a text file (test.txt) for exfiltration.
This allows the threat actor to check the privileges of the compromised account and explore lateral movement opportunities within the breached environment.
Observed traces of CVE-2025-10035 exploitation
Source: WatchTowr
BleepingComputer has contacted Fortra requesting a comment on WatchTowr's findings, but we have not received a response yet.
Given the active exploitation status for CVE-2025-10035, system administrators who haven't taken action, are recommended to upgrade to a patched version, either 7.8.4 (latest) or 7.6.3 (Sustain Release).
One mitigation is to remove public internet exposure for the GoAnywhere Admin Console.
Fortra has also recommends that admins inspect log files for errors containing the string 'SignedObject.getObject,' to determine if an instance has been impacted.