Article

Managed File Transfer Exploits: Here to Stay?

Cybercriminals are actively exploiting recently disclosed vulnerabilities in two prominent Managed File Transfer (MFT) products. Initially discovered by cybersecurity researchers, CVE-2025-11371 is an unauthenticated Local File Inclusion vulnerability in Gladinet’s MFT product, CentreStack. This vulnerability ultimately enables an exploit chain allowing remote code execution (RCE) that was patched by Gladinet earlier this year (CVE-2025-30406).

Meanwhile, Fortra confirmed the targeting of a vulnerability, CVE-2025-10035, in its GoAnywhere MFT product. Although the extent of this latest campaign is unknown, researchers have observed ongoing exploitation of the vulnerability by a threat group known for deploying Medusa ransomware. The vulnerability also results in RCE due to improper deserialization.

Both vendors have patched these vulnerabilities in their product’s latest version.

What’s Notable and Unique

The recent attacks against Gladinet CentreStack are the second concerted effort this year to exploit vulnerabilities in this product. This speaks to threat actors’ perceived value of the source and the associated data. Given the access to sensitive data and broad reach within the network that generally accompany MFT systems, it’s easy to see why cybercriminals continue to return to this product.
Although patches for both CentreStack and GoAnywhere MFT have been released, Arete recommends that organizations continue to proactively hunt for any suspicious activity involving these products. In recent years, cybercriminals have heavily targeted and leveraged MFT software in their operations. Arete does not foresee any near-term deviation in this trend.

Analyst Comments

The activity described in this article is far from novel and in no way isolated. This summer, security researchers warned of notable surges in scanning activity targeting the well-known (and previously exploited) MFT software, MOVEit. CrushFTP and Cleo’s LexiCom, VLTransfer, and Harmony products have also received attention from threat actors this year. Although MFT products are powerful tools for a business, they also present an enticing target for cybercriminals and should be evaluated and deployed with care and closely monitored. Arete has responded to several incidents in which MFT software was utilized by the threat actor. Cybercriminals view these platforms not only as a way to access sensitive data, but also as an ideal vector for initial entry into a network, making continued exploitation likely for the foreseeable future.