[Stanley]

Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure

Cybersecurity company watchTowr Labs has disclosed that it has "credible evidence" of active exploitation of the recently disclosed security flaw in Fortra GoAnywhere Managed File Transfer (MFT) software as early as September 10, 2025, a whole week before it was publicly disclosed.
"This is not 'just' a CVSS 10.0 flaw in a solution long favored by APT groups and ransomware operators – it is a

https://thehackernews.com/2025/09/fortra...-flaw.html

[Oh_Well]

Serious stuff, a CVSS 10 flaw being exploited before disclosure means someone was already in the know

[Fish]

Good on them for publicly disclosing the exploit. One week is still a long time to wait though

[Aeowulf]

Used in the wild for at LEAST two weeks before it was discovered. Damn.

[Vectura]

That’s bad, a CVSS 10 exploit used before disclosure is as serious as it gets. Anyone running GoAnywhere needs to act fast.

[plops]

Damn a 10/10. Im sure file transfers are probably close to the worse

[The Joker]

Hmm. Someone made a backdoor and got caught..

[B3A]

This one seems like an inside job

[DAL-SHA]

Zero-day exploit hitting Fortra GoAnywhere before disclosure is scary😈 Shows how attackers act fast once flaws leak—patches must be urgent✌✌