Sophos vulnerabilities

CVEs per yearBy the year they were published

1. 202213
2. 20232
3. 202317
4. 20231
5. 20256
6. 20258
7. 20262

Known exploitedNewest addition to KEV first

• CVE-2023-1671

  A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

  Sophos · Sophos Web Appliance

  ExploitedCritical9.8
• CVE-2022-3236

  A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

  Sophos · Sophos Firewall

  ExploitedCritical9.8
• CVE-2022-1040

  An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.

  Sophos · Sophos Firewall

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-118633

  A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race…

  Sophos · SG UTM

  Critical9.2
• CVE-2026-18367

  A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos…

  Sophos · Sophos Endpoint for macOS

  Critical9.3
• CVE-2025-10159

  An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than…

  Sophos · AP6 Series Wireless Access Points

  Critical9.8
• CVE-2024-13973

  A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving…

  Sophos · Sophos Firewall

  Medium6.8
• CVE-2024-13974

  A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the…

  Sophos · Sophos Firewall

  High8.1
• CVE-2025-7382

  A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code…

  Sophos · Sophos Firewall

  High8.8
• CVE-2025-7624

  An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code…

  Sophos · Sophos Firewall

  Critical9.8
• CVE-2025-6704

  An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth…

  Sophos · Sophos Firewall

  Critical9.8
• CVE-2025-7433

  A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.

  Sophos · Sophos Intercept X for Windows

  High8.8
• CVE-2024-13972

  A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining…

  Sophos · Sophos Intercept X for Windows Core Agent

  High8.8