Goanywhere Mft Auth Bypass CVE-2025-10035

Tim Peck@timpeck

•updated Sep 26, 2025•0•113

Detects attempts to bypass authentication in Fortra GoAnywhere MFT by exploiting a vulnerability (CVE-2025-10035). This is achieved by sending a crafted GET request to the Unlicensed.xhtml endpoint to trigger an exception and obtain a valid license request token, which is a prerequisite for further exploitation.