Fortra GoAnywhere MFT License Servlet deserialization flaw may lead to command injection

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

• The normalized record identifies Fortra GoAnywhere MFT versions up to and including 7.8.3 as affected.
• Fortra's advisory ties practical exposure to deployments with the GoAnywhere Admin Console exposed to the public Internet and states that other web components are not affected.
• Fortra's follow-up states that hotfixes were created for the 7.6.x, 7.7.x, and 7.8.x branches, and identifies 7.6.3 and 7.8.4 as full releases containing the fix.
• Because the broad normalized range through 7.8.3 does not reconcile every branch after those fixes were released, it should not be read as proof that every version at or below 7.8.3 remains vulnerable. Verify the installed version against Fortra's branch-specific guidance.

Fortra identifies the affected component as the GoAnywhere MFT License Servlet. The flaw occurs when the servlet processes a license response with a validly forged signature and deserializes an arbitrary object controlled by the actor. The advisory's example trace shows the path through java.io.ObjectInputStream.readObject, java.security.SignedObject.getObject, com.linoma.license.gen2.BundleWorker, and LicenseResponseServlet.doPost. This confirms the deserialization path, but the published material does not explain how the signature is forged, what object payload is used, or the exact mechanism by which command execution would occur. Exploitation depends on the GoAnywhere Admin Console being reachable from the public Internet; Fortra states that other web components in the GoAnywhere architecture are not affected.

The supplied record characterizes the issue as network reachable, requiring no application privileges or user interaction, with low attack complexity. The attacker must nevertheless produce a license response with a validly forged signature, which is an important technical precondition. The record marks the vulnerability as known exploited and publicly exploitable. Fortra also reported potentially suspicious activity on three MFTaaS instances and a limited number of reports of unauthorized activity related to the vulnerability. The available public evidence does not identify a specific campaign, payload, or exploit chain.

If exploitation succeeds, actor-controlled data can be deserialized by the License Servlet and may lead to command injection. Possible technical consequences include reading or modifying data, changing configuration, creating unauthorized activity, or disrupting GoAnywhere MFT services. The supplied scoring metadata describes impacts to confidentiality, integrity, and availability, but the public material does not establish the exact privileges obtained after command execution or any lateral-movement path.

The practical exposure is constrained by Admin Console reachability: Fortra states that the risk is concentrated in consoles exposed to the public Internet. A deployment without the named log indicators cannot be treated as proven safe.

Successful exploitation could enable command execution on the system running GoAnywhere MFT, creating risks to the confidentiality, integrity, and availability of transferred data and related services. A compromised instance may require investigation of administrator activity, configuration integrity, and connected systems.

Operational exposure is concentrated in deployments that allow direct public access to the Admin Console. Fortra states that other web components are not directly affected by this vulnerability and reported a limited number of unauthorized-activity reports at the time of its investigation. That statement does not remove the risk from unpatched systems or deployments showing signs of exploitation.

1. Remove public exposure immediately: Ensure that the GoAnywhere Admin Console is not open to the public Internet. This is the most important risk-reduction step while upgrading.
2. Install a release named by Fortra as fixed: Upgrade GoAnywhere MFT to 7.8.4 or the Sustain Release 7.6.3.
3. Address the 7.7.x branch: Apply the corresponding hotfix supplied by Fortra for that branch. The public material reviewed does not identify one final version covering all of 7.7.x, so a fixed release must not be inferred.
4. Check for compromise: Review Admin Audit logs and userdata/logs/ for the indicators described by Fortra, especially SignedObject.getObject:. If indicators are present, investigate the instance before simply returning it to Internet exposure.
5. For MFTaaS, verify that the hosted instance has been updated to a fixed release and that Admin Console access remains restricted.

1. Inventory GoAnywhere MFT deployments, record their versions and release branches, and compare them with Fortra's branch-specific remediation guidance.
2. Check whether the GoAnywhere Admin Console is exposed to the public Internet.
3. Review Admin Audit logs for unknown or newly created administrator accounts and other unexpected behavior.
4. Search userdata/logs/ for errors containing SignedObject.getObject: and review related exception traces for license-response parsing. The presence of this string indicates that an instance may have been affected, but it does not by itself establish the full extent of compromise.
5. If indicators are found, preserve relevant logs and begin incident investigation. The absence of these indicators does not prove that a deployment is safe.