Sophos vulnerabilities
We track 31 vulnerabilities in Sophos products across 23 products. 31 are rated high or critical, and 7 have been exploited in real attacks. The most recent was published on October 28, 2026.
Latest Sophos vulnerabilities
- 8.1 High severity
SG UTM: Path Traversal: '.../...//'
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning en
- 9.3 Critical severity
Sophos Endpoint for macOS: Improper Authorization
A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.
- 9.8 Critical severity
AP6 Series Wireless Access Points: Unverified Password Change
An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7).
- 9.8 Critical severity
Sophos Firewall: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0
- 8.8 High severity
Sophos Firewall: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP authentication for the admin user is ena
- 9.8 Critical severity
Sophos Firewall: Improper Neutralization of Special Elements used in an OS Command
An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall
- 8.1 High severity
Sophos Firewall: Reliance on Untrusted Inputs in a Security Decision
A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.
- 7.2 High severity
Sophos Firewall: Improper Neutralization of Special Elements used in an SQL Command
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.
- 8.8 High severity
Sophos Intercept X for Windows: Deserialization of Untrusted Data
A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.
- 7.5 High severity
Sophos Intercept X for Windows Installer: Uncontrolled Search Path Element
A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM.
- 8.8 High severity
Sophos Intercept X for Windows Core Agent: Incorrect Default Permissions
A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SYSTEM level privileges during a product upgrade.
- 7.8 High severity
Taegis Endpoint Agent (Linux): Improper Control of Generation of Code
A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code execution as root. Redhat-based systems using RPM packages are not affected.
- 8.8 High severity
Sophos Firewall: Improper Control of Generation of Code
A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1).
- 9.8 Critical severity
Sophos Firewall: Improper Neutralization of Special Elements used in an SQL Command
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SP
- 8.8 High severity
Sophos Intercept X: Deserialization of Untrusted Data
A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files.
- 7.5 High severity
Sophos Firewall: Insufficiently Protected Credentials
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.
- 9.8 Critical severity
Sophos Web Appliance Command Injection Exploited
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
- 7.2 High severity
Sophos Web Appliance: Improper Neutralization of Special Elements used in a Command
A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.
- 8.8 High severity
Sophos Firewall: Improper Control of Generation of Code
A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.
- 8.4 High severity
Sophos Firewall: Improper Neutralization of Input During Web Page Generation
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.
- 7.2 High severity
Sophos Firewall: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.
- 9.8 Critical severity
Sophos Mobile managed on-premises: Improper Restriction of XML External Entity Reference
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.
- 9.8 Critical severity
Sophos Firewall Code Injection Exploited
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
- 7.2 High severity
Sophos Firewall: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1.
- 9.8 Critical severity
Sophos Firewall Authentication Bypass Exploited
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
- 7.8 High severity
Sophos UTM: Insertion of Sensitive Information into Log File
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.
- 8.8 High severity
Sophos UTM: Improper Neutralization of Special Elements used in an SQL Command
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.
- 9.8 Critical severity
CyberoamOS (CROS) SQL Injection Exploited
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
- 9.8 Critical severity
Sophos SG UTM Remote Code Execution Exploited
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
- 9.8 Critical severity
Sophos XG Firewall Buffer Overflow Exploited
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
- 9.8 Critical severity
Sophos SFOS SQL Injection Exploited
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal expos