Fortra GoAnywhere MFT Insecure Deserialization via License Servlet (CVE-2025-10035)

Tim Peck@timpeck

•updated Nov 11, 2025•0•37

This rule detects an attempted exploitation of an insecure deserialization vulnerability (CVE-2025-10035) in Fortra GoAnywhere MFT. Specifically, it looks for HTTP POST requests to the '/goanywhere/lic/accept/' URI containing the string 'bundle=' in the request body, which is indicative of an attempt to trigger the vulnerability.