GoAnywhere MFT command injection via license deserialization

9 June 2026 elevated vulnerability

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Deserialization flaw in GoAnywhere MFT allows forged license signatures to inject commands; patch to 7.8.4 or 7.6.3.

Fortra's GoAnywhere Managed File Transfer (MFT) contains a deserialization vulnerability in its License Servlet that enables command injection. An attacker with a validly forged license response signature can deserialize arbitrary actor-controlled objects, potentially achieving command injection on affected systems. Versions prior to 7.8.4 (or Sustain Release 7.6.3) are vulnerable. The attack requires external network access to the GoAnywhere Admin Console, making internet-exposed instances the primary risk vector.

There are currently no reports of in-the-wild exploitation. Fortra recommends immediate patching after testing and restricting network access to the Admin Console. Defenders should apply updates urgently, implement network segmentation to prevent public exposure of the administration interface, and review access controls to the GoAnywhere MFT deployment.

Mentioned in this report

Vulnerabilities CVE-2025-10035KEV

Detection guidance

GoAnywhere MFT Java Process Spawning Shell or Recon/Download Utility (Windows)

ATT&CK T1190

Detects the GoAnywhere MFT Java/Tomcat service spawning a command interpreter or common post-exploitation utility, consistent with command injection via the License Servlet deserialization flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: GoAnywhere MFT Java Process Spawning Shell or Recon/Download Utility (Windows)
description: Detects the GoAnywhere MFT Java/Tomcat service process spawning cmd,
  PowerShell or common recon/download utilities. This is consistent with command injection
  after License Servlet deserialization abuse. Matches the parent/child relation,
  not specific payloads.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-goanywhere-managed-file-transfer-mft-could-allow-for-command-injection_2025-088
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \GoAnywhere\
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \whoami.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
    - \net.exe
    - \net1.exe
    - \nltest.exe
    - \mshta.exe
    - \rundll32.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Administrators running custom GoAnywhere workflow tasks that deliberately invoke
  cmd or PowerShell scripts
- Vendor-provided maintenance or upgrade scripts launched from the GoAnywhere service
level: high
id: 88fb275a-3090-528b-a4c6-4a476ac53531
status: experimental
author: Vorant

GoAnywhere MFT Java Process Spawning Shell or Download Utility (Linux)

ATT&CK T1190

Detects the GoAnywhere MFT Java process on Linux spawning a shell or download/recon utility, indicating possible command injection through the License Servlet. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: GoAnywhere MFT Java Process Spawning Shell or Download Utility (Linux)
description: Detects a Java process running from a GoAnywhere installation directory
  spawning a shell or download/recon utility. This is consistent with command injection
  after License Servlet deserialization abuse.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-goanywhere-managed-file-transfer-mft-could-allow-for-command-injection_2025-088
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: goanywhere
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
    - /whoami
    - /nc
    - /python
    - /python3
    - /perl
  condition: selection_parent and selection_child
falsepositives:
- GoAnywhere workflow tasks or maintenance scripts that intentionally call shell commands
- Vendor upgrade or service-wrapper scripts launched from the Java process
level: high
id: 61c2d219-616b-54ec-8cfe-59ec14bc4f2a
status: experimental
author: Vorant

Web Requests to GoAnywhere License Servlet Endpoint

ATT&CK T1190

Detects POST requests to the GoAnywhere license servlet path in web or reverse proxy logs, which should be rare from external sources and may indicate forged license-response deserialization attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Requests to GoAnywhere License Servlet Endpoint
description: Detects POST requests to GoAnywhere license servlet paths in web server
  or reverse proxy logs. The License Servlet is the deserialization entry point, so
  external clients posting forged license responses are suspicious. Review source
  address and request volume (several requests from one source in a short time raise
  confidence).
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-goanywhere-managed-file-transfer-mft-could-allow-for-command-injection_2025-088
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains|all:
    - /goanywhere/
    - /lic
  condition: selection
falsepositives:
- Legitimate license activation or renewal traffic initiated during product installation
  or upgrade
- Vulnerability scanners probing the GoAnywhere admin console
level: medium
id: 0579f2af-7248-5471-9fa9-c9b75eaa9e16
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-goanywhere-managed-file-transfer-mft-could-allow-for-command-injection_2025-088

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs