Backstory
The code at the center of CVE-2025-10035 is older than the company that shipped it. Class names in the vulnerable path, com.linoma.ga.ui.admin.servlet.LicenseResponseServlet and com.linoma.license.gen2, trace back to Linoma Software, a Nebraska firm founded in 1994 that HelpSystems acquired in June 2016 and rebranded as Fortra in November 2022. The License Response Servlet exists to complete license activation. It listens on the administration port, default 8000, and it answers before anyone authenticates, because activation has to work on a system that is not yet licensed.
That servlet has failed before. In February 2023, CVE-2023-0669 let attackers reach the same code: the bundle parameter was base64 decoded, decrypted with hardcoded AES keys, and passed straight into ObjectInputStream.readObject(). Cl0p exploited it as a zero day, and Fortra patched it in version 7.1.2.
The 2023 fix is where the 2025 bug was born. Rather than remove the deserialization, Fortra fenced it with three gates: a session-bound license request token, a ValidatingObjectInputStream whitelist restricting types to SignedObject and byte[], and RSA-SHA512 signature verification. The gates were intended as defense in depth. The whitelist permitted SignedObject, whose getObject() performs a second, unrestricted deserialization the moment verify() returns true, so the sink remained reachable. That left the signature as the only meaningful gate on it, resting on the assumption that only Fortra could produce a valid signature.
By 2025 each layer had been defeated. watchTowr showed the token could be minted without authentication by way of /goanywhere/license/Unlicensed.xhtml, and the whitelist was satisfied by the class it permitted. The signing key remained the open question. Rapid7 described a chain of three issues including "an as-yet unknown issue regarding how an attacker can know a specific private key," and watchTowr, unable to reproduce a valid signature from keys shipped inside the product, wrote: "Either we are missing a trick, or the check is genuinely solid." Fortra's patch replaced getObject with a wrapper named deserializeUntrustedSignedObject. The signature verification logic, in watchTowr's words, was "Completely untouched."
Fortra published its advisory on September 18, 2025, telling customers to ensure the Admin Console is not open to the public and noting that exploitation "is highly dependent upon systems being externally exposed to the internet". It did not mention exploitation in the wild, which watchTowr dated to September 10.
Technical analysis (revisited)
The original analyst note, written on disclosure day, described the bug accurately as far as the advisory went: an insecure deserialization in the License Servlet, reachable by an attacker who embeds a malicious serialized object in a license response carrying a validly forged signature. It listed the affected versions as "see vendor advisory." The CVE record has since filled that in as GoAnywhere MFT up to and including 7.8.3, classified under both CWE-502 and CWE-77. Fortra scores it CVSS 10.0 with Scope:Changed; NIST independently scores 9.8 with Scope:Unchanged, a disagreement about blast radius rather than about severity.
What post-disclosure research added is that this is not one bug. Rapid7's root-cause analysis frames it as three: an access-control bypass known since 2023, the deserialization sink itself, and an unexplained third element, namely how an attacker came to hold the private key. watchTowr reverse-engineered the first two, showing that a malformed ViewState against Unlicensed.xhtml throws an exception, redirects to the admin error handler, and returns a valid license-request token encrypted with hardcoded keys. They could not complete the chain. Several private keys shipped inside GoAnywhere were tested against the public key in play, and none matched. VulnCheck reached the same wall independently.
Three firms concluded exploitation requires a signing key that is not public. The bug was nonetheless exploited as a zero day, which means one or more adversaries held a valid key. Fortra has not publicly explained how an attacker obtained one, and that question remains open.
For defenders, Fortra's own detection guidance is the useful artifact: search GoAnywhere log files for exception stack traces containing SignedObject.getObject, which indicates the instance was targeted regardless of whether the attempt succeeded.
Lifecycle timeline
Real-world outcome
The original analyst note, dated September 18, 2025, recorded "Public Exploit Available: False" and "no known public exploits or active exploitation campaigns," and predicted that exploitation was imminent and that the CVE was "a prime candidate for future inclusion" on CISA KEV. By that date, in-the-wild exploitation had in fact begun around September 10 per watchTowr, and the CVE was added to CISA KEV eleven days later, on September 29.
Exploitation began around September 10 or 11, before the advisory existed. Microsoft Threat Intelligence attributed it to Storm-1175, a financially motivated group that exploits public-facing applications and deploys Medusa ransomware. The observed chain used the deserialization flaw for initial access, then SimpleHelp and MeshAgent for persistence, netscan for discovery, RDP for lateral movement, Cloudflare tunnels and RMM infrastructure for command and control, and Rclone for exfiltration before the ransomware ran. CISA added the CVE on September 29 with ransomware use already marked "Known," a week ahead of Microsoft's public attribution.
The exposed population was smaller than the severity suggests. Censys observed 740 GoAnywhere MFT instances on September 18, of which 65 reported a version banner and 40 confirmed vulnerable builds. That 40 is a floor, not an estimate. Fortra reported "a limited number" of unauthorized-activity reports and has not published a victim count.
Lessons
This case shows that gating a dangerous sink is not the same as removing it. The 2023 fix left ObjectInputStream in a pre-auth code path and stacked three checks in front of it, one of which whitelisted the exact class that reopens the sink. The pattern it illustrates is that the review question for a deserialization patch is not whether input can still reach the sink but what happens after every check passes, including whether any allowed type performs deserialization of its own.
It also shows that a cryptographic signature check is only as trustworthy as the custody of the signing key. The security model here reduced to one private key held by the vendor, with no defense in depth and no revocation path, and when it failed there was no public account of how. A product that trusts a signature its operators cannot inspect, rotate, or verify the custody of concentrates risk in a single external secret.
For managed file transfer specifically, the exposure data frames the admin console as a standing target rather than an incident-response concern. Fortra's mitigation was network-exposure guidance, and Censys's numbers indicate most reachable instances were already restricted; the ones that remained internet-facing were the instances targeted.
References