[Stanley]

From Detection to Patch: Fortra Reveals Full Timeline of CVE-2025-10035 Exploitation

Fortra on Thursday revealed the results of its investigation into CVE-2025-10035, a critical security flaw in GoAnywhere Managed File Transfer (MFT) that's assessed to have come under active exploitation since at least September 11, 2025.
The company said it began its investigation on September 11 following a "potential vulnerability" reported by a customer, uncovering "potentially suspicious

https://thehackernews.com/2025/10/from-d...veals.html

[Hackers]

Glad to hear they're following up, I have heard a few things about this in the last couple of weeks

[Vectura]

Glad they dropped the full timeline. GoAnywhere’s had a rough history with zero-days, so transparency helps. At least this time the patch came faster than the last round.

[PacketPilot]

Glad to hear they're following up, I have heard a few things about this in the last couple of weeks

Nice — full disclosure helps everyone stay ahead next time

[Hackers]

Nice — full disclosure helps everyone stay ahead next time

Yeah, very true!

[PacketPilot]

Yeah, very true!

Yes man

[Rsynced]

Remember 911 September 11 2001 ✌

[DAL-SHA]

Good transparency from Fortra ✌✌ , but this shows how slow patching can cost trust.

[Chorozon]

Glad to hear they're following up, I have heard a few things about this in the last couple of weeks

I half expected you to have a full POC

[Hackers]

I half expected you to have a full POC

I'm sure it's not too hard to make one if you have access to a server w/ this, but a little tricky to replicate without a demo server.

I didn't find any POCs easily, but this 1 user said he may release a POC for this in future:
github.com //orange0Mint //CVE-2025-10035_GoAnywhere

Here are some scanners to find vuln servers / check your own servers:

https://github.com//rxerium//CVE-2025-10035
https://github.com//ThemeHackers//CVE-2025-10035

Nothing illegal, they are just version # checkers^

[Chorozon]

I'm sure it's not too hard to make one if you have access to a server w/ this, but a little tricky to replicate without a demo server.

I didn't find any POCs easily, but this 1 user said he may release a POC for this in future:
github.com //orange0Mint //CVE-2025-10035_GoAnywhere

Here are some scanners to find vuln servers / check your own servers:

https://github.com//rxerium//CVE-2025-10035
https://github.com//ThemeHackers//CVE-2025-10035

Nothing illegal, they are just version # checkers^

Haha i was half right you are waiting fro a POC to release

[Hackers]

Haha i was half right you are waiting fro a POC to release

Heh, I'm not actively tracking, but you can find POCs here:

https://hackforums.net/showthread.php?tid=6311448

:)

[Chorozon]

Heh, I'm not actively tracking, but you can find POCs here:

https://hackforums.net/showthread.php?tid=6311448

:)

Thank you very much you sir are a scholar 💯

[Hackers]

Thank you very much you sir are a scholar 💯

heh no problem!

[leste]

The investigation starting on Sept 11 and the exploit being active since then...