Ethical Hacking News
Cybersecurity alert: A critical vulnerability in Fortra's GoAnywhere MFT product has already been actively exploited in the wild since September 10, 2025. Experts warn that defenders will have a harder time ensuring their systems' safety due to the sheer volume of logs that need to be trawled through. Stay informed and take immediate action to patch vulnerabilities.
Tens of thousands of organizations are at risk due to a critical vulnerability in Fortra's GoAnywhere MFT product (CVE-2025-10035).The vulnerability allows for remote code execution (RCE) and creation of backdoor admin accounts.Threat actors have successfully exploited the bug, and researchers have confirmed its exploitation status.The lack of transparency from Fortra has added fuel to the fire, making it difficult for defenders to ensure system safety.The incident highlights the need for organizations using MFT products to stay vigilant and take immediate action to patch vulnerabilities.
In recent weeks, cybersecurity experts have been sounding the alarm about a critical vulnerability in Fortra's popular managed file transfer (MFT) product, GoAnywhere MFT. The bug, identified as CVE-2025-10035, has already been actively exploited in the wild since September 10, 2025, putting tens of thousands of organizations at risk. As one researcher succinctly put it, "This is not just a CVSS 10.0 flaw; it's an attacker's playground," where threat actors can easily execute remote code execution (RCE) and create backdoor admin accounts.
The vulnerability was first disclosed by Fortra on September 18, but the company failed to provide any information about its exploitation status in its "Am I Impacted?" section. This lack of transparency has only added fuel to the fire, as researchers have now confirmed that the bug has been successfully exploited by threat actors. According to watchTowr's findings, attackers trigger the pre-auth deserialization bug to achieve RCE capability, then create backdoor admin accounts and web users before executing multiple follow-on payloads.
The consequences of this vulnerability are far-reaching, with experts warning that defenders will have a harder time ensuring their systems' safety due to the sheer volume of logs that need to be trawled through. "Unfortunately, the picture now painted allows for evidence-based confidence in the concern that Fortra's 'Am I Impacted?' section probably was not Fortra attempting to be overly helpful, but a thinly veiled way of sharing 'Indicators of Compromise,'" said watchTowr researcher Xeeted.
The GoAnywhere MFT bug is just the latest in a string of high-severity vulnerabilities affecting MFT products. In 2023, Cl0p exploited CVE-2023-0669, another zero-day vulnerability in Progress' MOVEit MFT, resulting in thousands of compromises affecting roughly 96 million individuals. This incident was particularly alarming, as it showed that threat actors were using these vulnerabilities to deploy ransomware and compromise downstream organizations.
The fact that tens of thousands of instances of GoAnywhere MFT remain publicly accessible has raised concerns about the potential for further exploitation. As one expert noted, "The picture now painted allows for evidence-based confidence in the concern that Fortra's 'Am I Impacted?' section probably was not Fortra attempting to be overly helpful, but a thinly veiled way of sharing 'Indicators of Compromise.'"
In light of this new information, cybersecurity experts are calling on Fortra to provide more transparent and timely updates about the exploitation status of CVE-2025-10035. "After our initial research into GoAnywhere MFT's CVE-2025-10035 raised more questions than answers, credible evidence shared with the watchTowr team now adds weight to our suspicions," said Benjamin Harris, CEO and founder of watchTowr.
The incident highlights the need for organizations using MFT products to stay vigilant and take immediate action to patch vulnerabilities. As one expert noted, "Many hands make light work in the SOC, but it takes a concerted effort from defenders to keep up with these types of threats."
In conclusion, the GoAnywhere MFT bug is a growing concern that requires immediate attention from organizations and cybersecurity experts alike. The lack of transparency from Fortra has only added fuel to the fire, as researchers have now confirmed that the bug has been successfully exploited by threat actors.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Perfect-10-Bug-A-Growing-Concern-for-Organizations-Using-Fortras-GoAnywhere-Managed-File-Transfer-ehn.shtml
https://go.theregister.com/feed/www.theregister.com/2025/09/26/an_apts_playground_goanywhere_perfect10/
Published: Fri Sep 26 23:23:37 2025 by llama3.2 3B Q4_K_M
