CVE-2025-10035 is a deserialization of untrusted data vulnerability in Fortra GoAnywhere MFT. CISA added it to the Known Exploited Vulnerabilities catalogue on 29 September 2025, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
How deserialization flaws become dangerous in managed file transfer software
deserialization of untrusted data is dangerous because the application may reconstruct attacker-controlled objects before it validates intent, privilege, or content. In a managed file transfer product, that can turn a normal intake path into a code execution or control-bypass pathway.
Why this class of vulnerability matters operationally
File transfer platforms often sit at a trust boundary, handling partner uploads, automation, and authenticated admin workflows. If an attacker can influence how data is deserialized, the result may be more than application instability, it can become a foothold into file movement, workflow orchestration, or adjacent systems that depend on the transfer service.
For broad prioritisation and exposure review, use the CVE Program record alongside the NIST National Vulnerability Database entry to confirm the authoritative vulnerability record and related metadata.
How organisations assess exposure and contain the blast radius
Exposure checks should start with an accurate asset inventory, then confirm whether any internet-facing or partner-facing GoAnywhere MFT instances exist in the environment. Because exploitation often targets externally reachable services first, teams should also review vendor advisories, reverse proxy paths, and any automation that routes files or jobs through the product.
Containment matters when immediate patching is not yet possible. Organisations should restrict network access to the service, tighten administrative reachability, and review whether the platform holds credentials, API keys, or other sensitive integration material that would widen the impact of a compromise. For a structured view of how to prioritise this kind of exposure, the Vulnerability Management Guide is a useful companion reference.
Detection, remediation, and post-exploitation review
Once a vulnerability has been exploited, the main question is no longer just whether the software is patched, but whether the environment was accessed before remediation. Look for unusual admin activity, unexpected file transfers, unfamiliar outbound connections, and signs that the service was used to stage follow-on access.
Remediation should include the vendor fix or mitigation, followed by a compromise review of adjacent assets and any secrets the application could access. If the service handled service accounts, tokens, or privileged integrations, rotate them as part of the recovery effort. The broader lesson from The State of NHI & AI Agent Breach Report 2026 is that breach impact often expands when a vulnerable system can reach valuable non-human credentials and sessions.
Risk and Threat Considerations
Deserialization flaws are attractive because they can convert a single request into arbitrary server-side behaviour, often before normal application checks can stop it. In a product that brokers files and automation, that can give attackers a direct path to execution, persistence, or lateral movement through trusted integrations.
Failure mechanism: The application trusts serialized input enough to rebuild objects or trigger unsafe processing, letting attacker-controlled data influence runtime behaviour.
Impact: Successful exploitation can expose files, credentials, sessions, or connected systems, and may require post-incident review beyond the patched application itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Input Validation | Covers rejecting unsafe input before it reaches vulnerable deserialization paths. |
| CM-7 — Least Functionality | Limits services and features that widen attack surface on transfer platforms. | |
| SI-2 — Flaw Remediation | Directly supports rapid remediation of an actively exploited product vulnerability. | |
| Recommendation — Validate and constrain deserialized inputs before processing them. Remove unnecessary features and disable unused functionality on the MFT server. Track, test, and deploy the vendor fix or mitigation without delay. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Addresses discovery, prioritisation, and remediation of known exploited flaws. |
| CIS-12 — Network Infrastructure Management | Supports restricting reachability of internet-facing transfer services. | |
| Recommendation — Prioritise KEV-listed vulnerabilities and verify remediation on exposed assets. Restrict inbound access to the MFT service and reduce exposure paths. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Covers design choices that prevent unsafe object handling and trust-boundary failures. |
| V16 — Security Logging and Error Handling | Supports detection and investigation of exploitation attempts and post-patch review. | |
| Recommendation — Design server-side processing to avoid unsafe deserialization of untrusted data. Log suspicious deserialization failures and review them for signs of exploitation. | ||
| MITRE ATT&CK | T1556 — Modify Authentication Process | Captures post-compromise abuse where attackers alter trust or authentication flows. |
| T1190 — Exploit Public-Facing Application | Directly models exploitation of a reachable application vulnerability. | |
| Recommendation — Hunt for tampering with trust and authentication flows after compromise. Treat internet-facing GoAnywhere instances as candidates for public-facing exploitation activity. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a priority exposure when the product is exposed to untrusted input paths, especially if it sits between external partners and internal systems. The practical issue is not only patching speed, but whether the platform can be used as a launch point into higher-value assets.
What to watch for: Reconcile service reachability, vendor remediation status, and any evidence of suspicious activity around the product during the exposure window. If compromise is suspected, assume that related credentials and integrations may also need rotation or reauthorization.
Practitioner takeaway: For exposed managed transfer systems, patching and compromise review should be treated as one workflow, not separate tasks.
Related resources from NHI Mgmt Group
- CVE-2025-26399 (SolarWinds Web Help Desk Deserialization of Untrusted Data)
- CVE-2025-49113 (RoundCube Webmail Deserialization of Untrusted Data)
- CVE-2025-40551 (SolarWinds Web Help Desk Deserialization of Untrusted Data)
- CVE-2025-59287 (Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org