Fortra has disclosed details of a critical security flaw in GoAnywhere Managed File Transfer (MFT) software that could result in the execution of arbitrary commands. The vulnerability, tracked as CVE-2025-10035, carries a CVSS score of 10.0, indicating maximum severity. That said, previously disclosed shortcomings in the same product (CVE-2023-0669, CVSS score: 7.2) were abused as a zero-day by ransomware actors to steal sensitive data. Then, early last year, it addressed another critical vulnerability in the GoAnywhere MFT (CVE-2024-0204, CVSS score: 9.8) that could have been exploited to create new administrator users. "With thousands of GoAnywhere MFT instances exposed to the Internet, this issue is almost certain to be weaponized for in-the-wild exploitation soon.