Sophos Firewall vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
19 matching records
- UnknownSophos Unified Threat Management (UTM) Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenCheck if you run itEPSS 0.60%Oct 29, 2026
- Critical9.8An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MCheck if you run itEPSS 0.91%Sep 9, 2025
- Medium6.8A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code executiCheck this weekEPSS 12.26%Jul 21, 2025
- High8.1A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment toCheck if you run itEPSS 9.07%Jul 21, 2025
- High8.8A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High AvaiCheck if you run itEPSS 4.86%Jul 21, 2025
- Critical9.8An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantiningCheck this weekEPSS 10.51%Jul 21, 2025
- Critical9.8An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code executionCheck this weekEPSS 11.77%Jul 21, 2025
- High8.8A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.Check if you run itEPSS 0.12%Jul 17, 2025
- High8.8A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SYSTEM level privilegesCheck if you run itEPSS 0.14%Jul 17, 2025
- High7.5A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer isCheck if you run itEPSS 0.14%Jul 17, 2025
- UnknownGzip .tar.gz Security BypassPatch nowKEVEPSS 98.15%Dec 7, 2023
- UnknownSophos mobile Improper Restriction of XML External Entity ReferencePatch nowKEVEPSS 9.79%Nov 13, 2023
- Critical9.8Sophos Web Appliance Command Injection VulnerabilityPatch nowKEVEPSS 100.00%Apr 4, 2023
- Critical9.8Sophos Firewall Code Injection VulnerabilityPatch nowKEVEPSS 98.91%Sep 16, 2022
- Critical9.8Sophos Firewall Authentication Bypass VulnerabilityPatch nowKEVEPSS 99.80%Mar 21, 2022
- Critical9.8CyberoamOS (CROS) SQL Injection VulnerabilityPatch nowKEVEPSS 4.70%Dec 11, 2020
- Critical9.8Sophos SG UTM Remote Code Execution VulnerabilityPatch nowKEVEPSS 96.75%Sep 24, 2020
- Critical9.8Sophos XG Firewall Buffer Overflow VulnerabilityPatch nowKEVEPSS 10.67%Jun 29, 2020
- Critical9.8Sophos SFOS SQL Injection VulnerabilityPatch nowKEVEPSS 42.43%Apr 22, 2020
Sort
19 records