
- CVE-2025-10035 in GoAnywhere MFT is being exploited by ransomware group Storm-1175
- Vulnerability enables unauthenticated remote code execution; Medusa ransomware was deployed in at least one case
- Patch released September 18; over 500 instances remain exposed, urging immediate upgrades or mitigation
Microsoft is warning that a ransomware group is exploiting a maximum-severity vulnerability recently found in GoAnywhere Managed File Transfer (MFT).