Back to the CVE list
CVE-2025-10035 CISA KEV · Actively exploitedLinked to ransomwareSuited to automated attack · CISA

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

CVSS score

10.0

EPSS probability

%99.8

Risk score

20.0

Published

1 y ago

OverviewPublic Exploits (5)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
sentinel-aidefense/CVE-2025-10035
GitHub

CVE-2025-10035 Research writeup

Public PoCSource updated: 13.07.2026 11:49:08
G
rxerium/CVE-2025-10035
GitHub

Detection for CVE-2025-10035

Public PoCSource updated: 13.07.2026 12:07:48
G
orange0Mint/CVE-2025-10035_GoAnywhere
GitHub

CVE-2025-10035_GoAnywhere Get RCE

Public PoCSource updated: 27.09.2025 09:17:13
G
ThemeHackers/CVE-2025-10035
GitHub

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Public PoCSource updated: 26.09.2025 06:54:01
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-10035.yaml
Nuclei

Nuclei: GoAnywhere - Authentication Bypass

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-10035"