Threat database

CVE-2026-18367 is a critical privilege escalation vulnerability in Sophos Endpoint for macOS and Sophos Home for macOS. It allows local users to execute arbitrary code with root privileges due to improper or missing authorization checks. The vulnerability affects versions older than 2026.1.1 for Sophos Endpoint and older than 10.11.6 for Sophos Home. The CVSS score is 9.3, indicating a high severity with complete confidentiality, integrity, and availability impact. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7).

EPSS 0.9%VulnerabilitySophos#cwe-620Germany+9

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP authentication for the admin user is enabled.

EPSS 4.9%VulnerabilitySophos#cwe-78United Kingdom+9

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.

EPSS 10%VulnerabilitySophos#cwe-89United Kingdom+9

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode.

EPSS 11%VulnerabilitySophos#cwe-78Germany+9

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.

EPSS 0.1%VulnerabilitySophos#cwe-502United Kingdom+7

A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM.

EPSS 0.1%VulnerabilitySophos#cwe-427United Kingdom+7

Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall combined exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction. Cisco IOS XE was the only platform with increased exposure. Geographically, most exposures remain concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices raises questions about remediation efforts and organizational responses to these threats.

KEVEPSS 98%MalwareSophos#chinese state-sponsored#masol ratGermany+6

A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code execution as root. Redhat-based systems using RPM packages are not affected.

EPSS 0.2%VulnerabilitySophos#cwe-732United States+9

CyberoamOS (CROS) contains a SQL injection vulnerability in its WebAdmin interface that allows unauthenticated remote attackers to execute arbitrary SQL commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability is classified as high severity due to its potential impact on system integrity and confidentiality.

Sophos XG Firewall has a buffer overflow vulnerability in its HTTP/S bookmark feature that enables remote code execution. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided.

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

KEVEPSS 99%VulnerabilitySophosUnited KingdomGermany+8

CVE-2022-1040 is an authentication bypass vulnerability in the User Portal and Webadmin interfaces of Sophos Firewall. This flaw allows remote attackers to bypass authentication controls, potentially leading to remote code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided in the available data.

CVE-2020-25223 is a high severity remote code execution vulnerability in the WebAdmin interface of Sophos SG UTM. It has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

CVE-2020-12271 is a SQL injection vulnerability in Sophos Firewall operating system (SFOS) firmware. It occurs when the administration (HTTPS) service or User Portal is exposed on the WAN zone. Exploitation can lead to remote code execution and exfiltration of usernames and hashed passwords for local device admins, portal admins, and remote access user accounts. External Active Directory or LDAP passwords are not affected. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.