Sophos Firewall security vulnerabilities
Networking / NAS. Public CVE monitoring for Sophos Firewall. Vendor security advisories are linked on this page.
Built for Operators of this product.
19 public records · 0 security-fix timeline events. 0 published in the last 7 days. 12 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-08-100 issues2026-11-07
Known exploited
View all known exploited- Critical9.8Sophos XG Firewall Buffer Overflow VulnerabilityPatch nowKEVEPSS 10.67%Jun 29, 2020
- Critical9.8CyberoamOS (CROS) SQL Injection VulnerabilityPatch nowKEVEPSS 4.70%Dec 11, 2020
- Critical9.8Sophos Web Appliance Command Injection VulnerabilityPatch nowKEVEPSS 100.00%Apr 4, 2023
- Critical9.8Sophos Firewall Code Injection VulnerabilityPatch nowKEVEPSS 98.91%Sep 16, 2022
- Critical9.8Sophos SG UTM Remote Code Execution VulnerabilityPatch nowKEVEPSS 96.75%Sep 24, 2020
- Critical9.8Sophos Firewall Authentication Bypass VulnerabilityPatch nowKEVEPSS 99.80%Mar 21, 2022
- Critical9.8Sophos SFOS SQL Injection VulnerabilityPatch nowKEVEPSS 42.43%Apr 22, 2020
Recently published
Browse catalog- Critical9.8An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MCheck if you run itEPSS 0.91%Sep 9, 2025
- Medium6.8A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code executiCheck this weekEPSS 12.26%Jul 21, 2025
- High8.1A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment toCheck if you run itEPSS 9.07%Jul 21, 2025
- High8.8A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High AvaiCheck if you run itEPSS 4.86%Jul 21, 2025
- Critical9.8An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantiningCheck this weekEPSS 10.51%Jul 21, 2025
- Critical9.8An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code executionCheck this weekEPSS 11.77%Jul 21, 2025
- High8.8A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.Check if you run itEPSS 0.12%Jul 17, 2025
- High8.8A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SYSTEM level privilegesCheck if you run itEPSS 0.14%Jul 17, 2025
- High7.5A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer isCheck if you run itEPSS 0.14%Jul 17, 2025
- Critical9.8Sophos Web Appliance Command Injection VulnerabilityPatch nowKEVEPSS 100.00%Apr 4, 2023