#fortra

Analysis · May 5, 2026 · The Field Notes Desk

GoAnywhere MFT gets its third critical RCE in three years

Storm-1175 was exploiting CVE-2025-10035 two days before Fortra even shipped the hotfix to customers. Under 24 hours from initial access to ransomware. GoAnywhere's third year in a row.