Microsoft Security Blog: Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability

Oct 6, 2025

—

Source URL: https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/
Source: Microsoft Security Blog
Title: Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability

Feedly Summary: Storm-1175, a financially motivated actor known for deploying Medusa ransomware and exploiting public-facing applications for initial access, was observed exploiting the deserialization vulnerability in GoAnywhere MFT’s License Servlet, tracked as CVE-2025-10035. We are publishing this blog post to increase awareness of this threat and to share end-to-end protection coverage details across Microsoft Defender.
The post Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability appeared first on Microsoft Security Blog.

AI Summary and Description: Yes

Summary: The text provides a detailed security advisory regarding a critical deserialization vulnerability (CVE-2025-10035) in GoAnywhere MFT, highlighting its implications for remote code execution and malicious exploitation by the cybercriminal group Storm-1175. It emphasizes the urgency of immediate patching to mitigate risks and outlines essential protective measures for organizations.

Detailed Description:
This security advisory details a critical vulnerability in GoAnywhere Managed File Transfer (MFT) that could have severe implications if exploited. The main points of the advisory include:

– **Vulnerability Overview**:
– The flaw is a deserialization vulnerability in GoAnywhere MFT’s License Servlet, assigned CVE-2025-10035, with a CVSS score of 10.0, indicating its critical severity.
– It could be exploited by an attacker with a forged license response signature, allowing command injection and potential remote code execution (RCE).

– **Threat Actor Activity**:
– The cybercriminal group Storm-1175 has been observed exploiting this vulnerability.
– Their tactics involved initial access gained through the vulnerability, using remote monitoring and management tools like SimpleHelp and MeshAgent for persistence.
– They executed commands for user and system discovery and employed Rclone for data exfiltration, culminating in the deployment of Medusa ransomware.

– **Mitigation Strategies**:
– Organizations are urged to upgrade to the latest version of GoAnywhere MFT per Fortra’s guidance.
– Recommendations for securing systems include:
– Use of attack surface management tools for identifying vulnerable systems.
– Configuration of perimeter firewalls to limit arbitrary internet access.
– Employing endpoint detection and response tools in block mode for better protection against malicious artifacts.

– **Microsoft Defender Protections**:
– Microsoft has rolled out protective measures within Microsoft Defender post-discovery of the vulnerability.
– Tools and tactics are discussed for detection and protection, such as leveraging Microsoft Defender for Endpoint for alerts related to exploitation attempts.

– **Security Copilot Features**:
– Introduction of Microsoft Security Copilot to help automate incident response and investigation tasks related to the vulnerability.
– Details are provided on threat analytics, hunting queries, and indicators of compromise that organizations can utilize for enhanced security.

– **Recommendations for Organizations**:
– Immediate action is necessary to mitigate risks associated with the vulnerability.
– Continuous monitoring and reviewing license verification mechanisms to identify and address suspicious activities are essential.

Overall, the advisory underscores the critical nature of CVE-2025-10035 and offers substantial guidance for IT and security professionals to safeguard their environments against potential exploitation.

1 10 2 2025 3 5 6 7 a access Act active exploitation advisory age agent AGI AI alerts All allow analytics and anti app Application applications art as at ated attack attack surface attacker Auto aware awareness Bi by C CI CIA co code code execution command command injection Configuration continuous continuous monitoring Copilot core coverage critical critical vulnerability cross CVE CVSS cyber cybercriminal D data data exfiltration de Defender deployment deserialization deserialization vulnerability detection e end endpoint endpoint detection endpoint detection and Endpoint Detection and Response enhanced security environment environments execution exfiltration exp exploit Exploitation face fact feature features file file transfer financial firewall firewalls first for g Gen Go grade Group guidance H high Highlight HR http HTTPS implications in incident incident response indicators indicators of compromise initial access injection inter intern internet internet access investigation io Iron IRS ite J k l law led Li license line lm Lock low M man managed file transfer management management tools measures media Medusa Ransomware MFT Micro Microsoft Microsoft Defender Microsoft Defender for Endpoint Microsoft Security Microsoft Security Blog Microsoft Security Copilot mitigation mitigation strategies Mode Monitor monitoring N no o of off on one ons opilot organization organizations ory oS oss out over Patch patching per persistence pilot point post potential pro professionals protection protective measures ps public publishing Q queries R rack rag ransom ransomware rate RCE re recommendations red remote Remote Code Execution Remote Monitoring Remote Monitoring and Management response review Risk risks Ro RoT s safe sec security security advisory Security Copilot security professionals serialization severity SHA Sig Sim Simple SimpleHelp size sizes SoC source SSE SSO STIG Storm strategies system systems T tactics Tails Task tasks ted test text the threat threat actor to tool tools Tor TP UI UN under up upgrade US use user V verification verification mechanisms version vulnerability Ware Wi x yt z