Sophos vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Sophos flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2020-29574 CyberoamOS (CROS) SQL InjectionExploited since Feb 6, 2025 · ransomware · CVSS 9.8
• CVE-2020-15069 Sophos XG Firewall Buffer OverflowExploited since Feb 6, 2025 · CVSS 9.8
• CVE-2023-1671 Sophos Web Appliance Command InjectionExploited since Nov 16, 2023 · CVSS 9.8
• CVE-2022-3236 Sophos Firewall Code InjectionExploited since Sep 23, 2022 · CVSS 9.8
• CVE-2022-1040 Sophos Firewall Authentication BypassExploited since Mar 31, 2022 · CVSS 9.8
• CVE-2020-25223 Sophos SG UTM Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 9.8
• CVE-2020-12271 Sophos SFOS SQL InjectionExploited since Nov 3, 2021 · ransomware · CVSS 9.8

Latest high and critical flaws

• CVE-2026-118633 A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condCritical 9.2 · Oct 28, 2026
• CVE-2026-18367 A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos HCritical 9.3 · Aug 6, 2026
• CVE-2025-10159 An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmwareCritical 9.8 · Sep 9, 2025
• CVE-2025-7624 An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code executionCritical 9.8 · Jul 21, 2025
• CVE-2025-7382 A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code exHigh 8.8 · Jul 21, 2025
• CVE-2025-6704 An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth rCritical 9.8 · Jul 21, 2025
• CVE-2024-13974 A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’sHigh 8.1 · Jul 21, 2025
• CVE-2025-7433 A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.High 8.8 · Jul 17, 2025
• CVE-2025-7472 A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges,High 7.5 · Jul 17, 2025
• CVE-2024-13972 A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SYSHigh 8.8 · Jul 17, 2025
• CVE-2024-13861 A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code exeHigh 7.8 · Apr 11, 2025
• CVE-2024-12729 A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (High 8.8 · Dec 19, 2024
• CVE-2024-12728 A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).Critical 9.8 · Dec 19, 2024
• CVE-2024-12727 A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting dCritical 9.8 · Dec 19, 2024
• CVE-2024-8885 A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary filesHigh 8.8 · Oct 2, 2024
• CVE-2023-5552 A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version High 7.1 · Oct 17, 2023
• CVE-2023-1671 Sophos Web Appliance Command InjectionExploited · Critical 9.8 · Apr 4, 2023
• CVE-2022-4934 A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitraHigh 7.2 · Apr 4, 2023
• CVE-2022-3713 A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.High 8.8 · Dec 1, 2022
• CVE-2022-3696 A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.High 7.2 · Dec 1, 2022
• CVE-2022-3226 An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.High 7.2 · Dec 1, 2022
• CVE-2022-3980 An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between vCritical 9.8 · Nov 16, 2022
• CVE-2022-3236 Sophos Firewall Code InjectionExploited · Critical 9.8 · Sep 23, 2022
• CVE-2022-1807 Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19High 7.2 · Sep 7, 2022
• CVE-2021-25268 Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA.High 8.4 · May 5, 2022