GoAnywhere MFT deserialization (CVE-2025-10035)

EPSS

0.998
very likely to be attacked soon

VEDAS

0.988
strong exploit evidence

On CISA KEV

Yes, since 2025-09-29

Detection rule

Nuclei · Suricata

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

VEDAS flagged this bug about 1 days before CISA confirmed attacks.