fromComputerWeekly.com
1 week agoAlert over Medusa ransomware attacks targeting Fortra MFT | Computer Weekly
CVE-2025-10035 is a critical deserialisation flaw - bearing a CVSS score of 10.0 - in the GoAnywhere MFT licence servlet. Left unaddressed, it enables a threat actor who has obtained a validly forged licence response signature to deserialise an arbitrary, actor-controlled object. Early reports suggest that an attacker does not need to authenticate if they can craft or intercept a valid licence response, making internet-exposed instances of GoAnywhere particularly vulnerable. Ultimately, exploitation can lead to command injection and remote code execution.
Information security