CVE-2022-3236

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0…

Critical9.8Known exploitedEPSS 98.9%

Published: 23 Sept 2022
Updated: 7 Oct 2026
Reserved: 17 Sept 2022
Assigned by: Sophos

Description

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Sophos Firewall Code Injection Vulnerability.

Added: 23 Sept 2022
Fix due (US federal): 14 Oct 2022
Used by ransomware: Not known

Apply updates per vendor instructions.

Scores

CVSS scores of CVE-2022-3236, by who scored it
Scored by	CVSS	Score	Vector
SophosCNA (assigner)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 98.9% · top 0.1% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

Sophos · Sophos Firewall
- affected unspecified – ≤ 18.5 MR4
- affected unspecified – ≤ 19.0 MR1

References (2)

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce (opens in a new tab)x_refsource_CONFIRMx_transferred
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-3236](https://trackcve.app/badge/CVE-2022-3236.svg)](https://trackcve.app/cve/CVE-2022-3236)

Record last updated 7 Oct 2026, 17:39 UTC.