Hackers are actively exploiting a maximum severity vulnerability (CVE-2025-10035) in Fortra's GoAnywhere MFT that allows injecting commands remotely without authentication.
The vendor disclosed the flaw on September 18, buit the company had learned about it a week earlier, and did not share any details on how it was discovered or if it was being exploited.
CVE-2025-10035 is a deserialization vulnerability in the License Servlet of the GoAnywhere managed file transfer software that can be leveraged to inject commands by "an actor with a validly forged license response signature."
Although Fortra's advisory hasn't been updated to include any information about the vulnerabililty being used in attacks, security researchers at WatchTowr Labs say that they received "credible evidence" of Fortra GoAnywhere CVE-2025-10035 being leveraged as a zero day.
"We have been given credible evidence of in-the-wild exploitation of Fortra GoAnywhere CVE-2025-10035 dating back to September 10, 2025," reads WatchTowr's report.
"That is eight days before Fortra's public advisory, published September 18, 2025," the researchers point out.
"This explains why Fortra later decided to publish limited IOCs, and we're now urging defenders to immediately change how they think about timelines and risk."
WatchTowr confirmed that the analyzed data contains the stack trace related to exploitation and the creatiuon of a backdoor account:
achieving remote command execution after exploiting the pre-auth deserialization vulnerability creating a backdoor admin account called admin-go using the account to create a web user that enabled "legitimate" access uploading and executing multiple secondary payloads
From the indicators of compromise WatchTowr published at the bottom of the report, the payloads are named 'zato_be.exe' and 'jwunst.exe.'
... continue reading