{"id":"CVE-2026-118633","title":"A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy i…","summary":"A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy i…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-35"],"vendor":"Sophos","product":"SG UTM","affected":["sg_utm <= 9.724"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T18:45:59.892Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118633","references":[{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce"}],"tags":["cve.org"],"epss":0.00595,"epssPercentile":0.4833,"ingestedAt":"2026-10-29T15:37:07.524Z","slug":"CVE-2026-118633","body":"## Overview\n\nA path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.\n\n## Affected\n\n- `sg_utm <= 9.724`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}