News Summary

• Fortra issued its own advisory, and a patch, on 18 September, but now, almost three weeks down the line, Microsoft said it had observed a cyber criminal actor exploiting the Fortra flaw.
• CVE-2025-10035 is a critical deserialisation flaw – bearing a CVSS score of 10.0 – in the GoAnywhere MFT licence servlet.
• Left unaddressed, it enables a threat actor who has obtained a validly forged licence response signature to deserialise an arbitrary, actor-controlled object.