Sophos has 3 CVEs on record between 2020 and 2026. 1 was published in the last 90 days. The median CVSS is 9.8 (critical), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 67% vs 1% corpus
- Median CVSS
- 9.8
- Publish → KEV
- —(2)
- Last 90 days
- 1 prev 0
Worst active — by depth score
CVE-2022-3236Critical· 9.8A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.99CVE-2020-29574Critical· 9.8An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.85CVE-2026-118633High· 8.1A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy i…45
Sophos vulnerabilities
CVEs affecting Sophos, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-118633High· 8.1A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy i…
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy i…
CVE-2022-3236Critical· 9.8CISA KEV0dayPoCA code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
CVE-2020-29574Critical· 9.8CISA KEVAn SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.