GoAnywhere MFT Zero‑Day Slips Past Firewalls, Lets Storm‑1175 Run Code

Microsoft Threat Intelligence disclosed that the Storm‑1175 threat group exploited CVE‑2025‑10035, a critical deserialization flaw in the license servlet of GoAnywhere Managed File Transfer. The vulnerability allowed the attackers to execute arbitrary code on the server while using normal HTTPS traffic, making the exploit blend in with legitimate application flows and evade traditional perimeter detection mechanisms.

Because the malicious activity appears as regular MFT traffic, firewalls and basic IDS/IPS solutions often miss it. Defenders must prioritize applying the vendor’s emergency patch, enforce strict application‑whitelisting, and implement deeper inspection such as TLS decryption or proxy logging for servlet calls. Network segmentation and continuous monitoring for anomalous GoAnywhere behavior are essential to prevent similar bypasses from compromising internal assets.

Categories: Vulnerabilities & Exploits, Threat Intelligence, Cloud & SaaS Security

Source: Read original article