GoAnywhere Zero-Day Vulnerability Fuels Medusa Ransomware Campaign

A deserialization flaw in a component most admins never think about.

CVE-2025-10035 is a deserialization-of-untrusted-data vulnerability in the GoAnywhere MFT License Servlet, affecting versions up to 7.8.3. Fortra rated it CVSS 10.0 - the highest score possible - because it can lead to command injection with no authentication once an attacker forges a valid license response signature.

Deserialization flaws are dangerous because they turn data that a system trusts into code the system runs. Here, an attacker who can forge a signed license response gets the GoAnywhere server to rebuild an attacker-controlled object, opening the door to command injection on the underlying host. The License Servlet is a component many organizations assumed was internal plumbing, not an internet-exposed attack surface. That assumption is what makes a 10.0 in file-transfer software so painful: the tool people bought specifically to protect sensitive data became the way in.

• Severity: CVSS 10.0, the maximum rating, per Fortra's advisory and the NVD entry.
• Affected versions: GoAnywhere MFT up to and including 7.8.3.
• Fix: upgrade to 7.8.4, or the 7.6.3 Sustain Release for organizations on that branch.
• Exploited as a zero-day: in the wild around September 10, 2025, roughly a week before the September 18 patch.
• CISA action: added to the Known Exploited Vulnerabilities catalog on September 29, 2025, which sets a federal remediation deadline and signals confirmed active exploitation.

Initial access was the start, not the finish.

Microsoft observed Storm-1175 chain the GoAnywhere flaw into a full intrusion: RMM tools for persistence, web shells and network scanning for discovery, Rclone for data theft over a Cloudflare tunnel, and finally Medusa ransomware. The single vulnerability was just the front door.

The sequence Microsoft documented reads like a standard modern ransomware playbook, which is exactly why it works. After exploiting CVE-2025-10035, the group dropped remote monitoring tools SimpleHelp and MeshAgent to hold access, then wrote .jsp files into the GoAnywhere directories as web shells. From there it ran user and system discovery, used netscan to map the network, and moved laterally with mstsc.exe. Data was staged and exfiltrated with Rclone, with a Cloudflare tunnel set up for command and control. In at least one environment, the operation finished with Medusa ransomware. In 35 years doing this, the lesson has not changed: the exploit gets attention, but the fifteen quiet steps after it are where an SMB actually loses.

Because you may run it, or your vendor does.

Managed file transfer software is common in exactly the sectors that anchor the Houston economy: energy, oil and gas, manufacturing, logistics, insurance, and the law firms and CPA practices that serve them. If you move regulated or contractual data on a schedule, GoAnywhere or a tool like it may be running in your environment right now.

Houston runs on data that has to move between parties: engineering drawings, well data, claims files, payroll, and legal discovery. MFT platforms exist to shuttle that data securely, which is precisely why a flaw in one is so valuable to a ransomware crew. And the exposure is not only direct. Storm-1175 has a history of hitting public-facing applications to reach whatever sits behind them, so a smaller Houston firm that supplies a larger enterprise can become the soft entry point into a bigger target. This is the third GoAnywhere flaw in recent years that ransomware groups have jumped on, after the widely abused 2023 vulnerability - a pattern, not a one-off.

• Inventory it. Confirm whether GoAnywhere MFT runs anywhere in your environment, including on a server a former admin stood up years ago.
• Get the admin console off the open internet. The License Servlet should never be reachable from the public internet; restrict it to trusted networks.
• Ask your vendors. If a partner in your supply chain runs GoAnywhere, their exposure can become yours.

The businesses that come through something like this cleanly are rarely the ones with the biggest budget. They are the ones that knew what they were running, kept it patched, and had someone watching. That is a process problem, not a spending problem, and it is one a small Houston firm can actually solve.