Research · Sep 18, 2025 · ZeroDay Catalog
Critical Deserialization Vulnerability in Fortra GoAnywhere MFT
A serious deserialization vulnerability has been identified in Fortra's GoAnywhere MFT, potentially allowing unauthorized command execution.
What changed
A deserialization vulnerability has been discovered in the License Servlet of Fortra's GoAnywhere MFT. This flaw permits an actor with a forged license response signature to deserialize arbitrary objects, which may lead to command injection attacks.
Who is affected
Organizations utilizing Fortra's GoAnywhere MFT are at risk due to this vulnerability. The impact could extend to various sectors relying on secure file transfer solutions.
- Fortra GoAnywhere MFT users
- Enterprises that depend on secure data transfer
- Organizations in regulated industries needing compliance
- IT departments managing file transfer protocols
What to do
It is crucial for affected organizations to assess their use of Fortra GoAnywhere MFT and implement necessary security measures. Monitoring for unusual activity and applying any available patches should be prioritized.
- Review and update GoAnywhere MFT to the latest version.
- Implement network segmentation to limit exposure.
- Monitor logs for any suspicious activity related to command execution.
- Educate staff on the risks associated with unauthorized access.