CVE-2023-0669 in GoAnywhere MFT is a pre-authentication deserialization flaw that achieved an EPSS score of 0.99999—meaning near-certain exploitation at disclosure. That score isn't a prediction; it's a confession. The vulnerability class has been documented since 2015 (Apache Commons Collections, CVE-2015-4852), and the specific pattern—license state reconstructed from client data via object deserialization at an unauthenticated endpoint—has appeared repeatedly in JBoss, WebLogic, Jenkins, and now GoAnywhere. The EPSS tells us attackers recognized the pattern instantly because it has a clear lineage.
The critical question isn't 'why did a developer choose unsafe deserialization'—it's 'why was that code path reachable without authentication in the first place?' This was a license validation endpoint that needed to process client-submitted data before user authentication occurred. The architecture created no friction against this dangerous pattern; it made the dangerous choice the path of least resistance. That is an API design failure, not merely a code-level mistake.
For defenders: audit your GoAnywhere deployments immediately—this is on the CISA KEV and was actively exploited in the wild. More importantly, treat this as a sentinel event for the entire MFT product category. These tools sit at the integration chokepoint between business partners, authenticated against AD, touching ERP workflows and cloud storage. Compromising an MFT system doesn't give you one server—it gives you a foothold in the exact管道 where sensitive data moves between organizational boundaries. The blast radius of any MFT compromise is architecturally maximum.
Look for other endpoints in GoAnywhere (and comparable MFT products) that handle pre-authentication data flows. The commit history question matters: what changed in version control that placed deserialization at an unauthenticated boundary, and did that change receive security review? The defensive tooling gap is that we built dependency checkers for vulnerable libraries, but no standard tool detects the architectural pattern of legitimate deserialization at authentication boundaries. That's the institutional memory failure—documented vulnerability class, documented exploit tooling, but no systematic detection of the API design anti-pattern that keeps producing these CVEs.