Sophos

Vulnerability activity for Sophos: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 1
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 1
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 1
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.8CriticalDec 11, 2020Sophos CyberoamOS SQL injectionCVE-2020-29574CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.Added to KEV Feb 6, 2025 · 1,517 days after publicationExploited4.7% likely
9.8CriticalJun 29, 2020Sophos XG Firewall Memory corruptionCVE-2020-15069Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.Added to KEV Feb 6, 2025 · 1,682 days after publicationExploited11% likely
9.8CriticalApr 4, 2023Sophos Web Appliance Code / command injectionCVE-2023-1671Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.Added to KEV Nov 16, 2023 · 226 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalSep 23, 2022Sophos Firewall Code / command injectionCVE-2022-3236A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.Added to KEV Sep 23, 2022 · same day as publicationExploited99% likelyExploit codeNucleiDetection
9.8CriticalMar 25, 2022Sophos Firewall Auth bypass / access controlCVE-2022-1040An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.Added to KEV Mar 31, 2022 · 5 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalSep 25, 2020Sophos SG UTM Code / command injectionCVE-2020-25223A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.Added to KEV Mar 25, 2022 · 546 days after publicationExploited97% likelyExploit codeMetasploit · NucleiDetection
10.0CriticalApr 27, 2020Sophos SFOS SQL injectionCVE-2020-12271Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).Added to KEV Nov 3, 2021 · 555 days after publicationExploited42% likely

Recent

8.1HighOct 28, 2026Sophos SG UTM Path traversal / file handlingCVE-2026-118633A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
9.8CriticalDec 11, 2020Sophos CyberoamOS SQL injectionCVE-2020-29574CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.Exploited4.7% likely
9.8CriticalJun 29, 2020Sophos XG Firewall Memory corruptionCVE-2020-15069Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.Exploited11% likely
9.8CriticalApr 4, 2023Sophos Web Appliance Code / command injectionCVE-2023-1671Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.Exploited100% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalSep 23, 2022Sophos Firewall Code / command injectionCVE-2022-3236A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.Exploited99% likelyExploit codeNucleiDetection
9.8CriticalMar 25, 2022Sophos Firewall Auth bypass / access controlCVE-2022-1040An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.Exploited100% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalSep 25, 2020Sophos SG UTM Code / command injectionCVE-2020-25223A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.Exploited97% likelyExploit codeMetasploit · NucleiDetection
10.0CriticalApr 27, 2020Sophos SFOS SQL injectionCVE-2020-12271Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).Exploited42% likely

See every Sophos entry on the dashboard.