Vendor

Sophos

49 known vulnerabilities.

Sophos at a glance

Last 12 months: 2
Critical · all time: 10
Exploited · all time: 3
Public exploit · all time: 3

New vulnerabilities per month · last 2412 months

Show as table

Month	Vulnerabilities	Critical
Nov 2026	0	0
Oct 2026	1	0
Sep 2026	0	0
Aug 2026	1	1
Jul 2026	0	0
Jun 2026	0	0
May 2026	0	0
Apr 2026	0	0
Mar 2026	0	0
Feb 2026	0	0
Jan 2026	0	0
Dec 2025	0	0
Nov 2025	0	0
Oct 2025	0	0
Sep 2025	1	1
Aug 2025	0	0
Jul 2025	8	2
Jun 2025	0	0
May 2025	0	0
Apr 2025	1	0
Mar 2025	0	0
Feb 2025	0	0
Jan 2025	0	0
Dec 2024	3	2

Most common weaknesses

Products

Sophos Firewall 21 Sophos Connect Client 4 Sophos UTM 3 Sophos Web Appliance 3 SG UTM 2 Sophos Home for macOS 2 Sophos Intercept X for Windows 1 Intercept X for Mobile (Android) 1 Sophos Authenticator (Android) 1 Sophos Secure Workspace for Android 1 HitmanPro 1 Sophos Intercept X 1 Sophos Email Appliance 1 Sophos Mobile managed on-premises 1 SSL VPN client 1 Taegis Endpoint Agent (Linux) 1 Sophos Intercept X for Windows Installer 1 Sophos Endpoint for macOS 1 AP6 Series Wireless Access Points 1 Intercept X for MacOS 1 Intercept X for MacOS (OPM) 1 Sophos Intercept X for Windows Core Agent 1 Intercept X Advanced 1 Intercept X Advanced for Server 1 Sophos Exploit Prevention 1 HitmanPro.Alert 1 XG Firewall 0 Firewall < v19.5.0 0 Firewall 0 Firewall < v19.5 MR3 0 Firewall < v19.5 MR2 0 Firewall < v20.0 EAP1 0 Firewall < v19.5 MR1-1 0 Firewall < v19.5 MR1 0 Firewall < v19.5 GA 0 Firewall < v19.0 MR3 0 Firewall < v19.0 MR2 0 Firewall < v19.0 MR1-1 0 Firewall < v19.0 MR1 0 Firewall < v19.5 MR4 0

Latest advisories

High max 9.8

WID-SEC-2022-0929 1 CVE rev. 46

zlib: Schwachstelle ermöglicht nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in zlib ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Oracle IBM Red Hat Dell Siemens Linux

Nov 11, 2026
first Aug 4, 2022
High max 8.1

WID-SEC-2026-4232 1 CVE

Sophos Unified Threat Management (UTM) Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Sophos Unified Threat Management (UTM) Software ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

Sophos

Oct 28, 2026
Medium max 7.5

WID-SEC-2022-0005 1 CVE rev. 67

zlib: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in zlib ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.

Oracle IBM Red Hat Dell Juniper Networks Linux

Aug 20, 2026
first Apr 3, 2022
High max 9.3

WID-SEC-2026-2690 1 CVE rev. 2

Sophos Endpoint für macOS: Schwachstelle ermöglicht Privilegieneskalation und Ausführen von beliebigem Programmcode mit Administratorrechten

Ein lokaler Angreifer kann eine Schwachstelle in Sophos Endpoint für macOS ausnutzen, um seine Privilegien zu erhöhen, und um beliebigen Programmcode mit Administratorrechten auszuführen.

Sophos macOS

Aug 9, 2026
first Aug 6, 2026
High max 9.8

WID-SEC-2022-0071 4 CVEs rev. 63

OpenSSL: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizu…

Oracle IBM Red Hat Dell Juniper Networks Linux Windows

Feb 9, 2026
first May 3, 2022

All Critical High Medium Low Exploited only Public exploit

49 results · Feed

High 8.1

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM…

Sophos SG UTM Network devices

Oct 28, 2026
Critical 9.3

CVE-2026-18367

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS…

Sophos Sophos Home for macOS Sophos Endpoint for macOS macOS Network devices

Aug 6, 2026
Critical 9.8

CVE-2025-10159

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series W…

Sophos AP6 Series Wireless Access Points Network devices

Sep 9, 2025
Medium 6.8

CVE-2024-13973 EPSS 12%

A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potent…

Sophos Sophos Firewall Network devices

Jul 21, 2025
High 8.1

CVE-2024-13974

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lea…

Sophos Sophos Firewall Network devices

Jul 21, 2025
High 8.8

CVE-2025-7382

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adja…

Sophos Sophos Firewall Network devices

Jul 21, 2025
Critical 9.8

CVE-2025-7624 EPSS 11%

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (…

Sophos Sophos Firewall Network devices

Jul 21, 2025
Critical 9.8

CVE-2025-6704 EPSS 12%

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than…

Sophos Sophos Firewall Network devices

Jul 21, 2025
High 8.8

CVE-2025-7433

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and …

Sophos Sophos Intercept X for Windows Windows Network devices

Jul 17, 2025
High 8.8

CVE-2024-13972

A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024…

Sophos Sophos Intercept X for Windows Core Agent Windows Network devices

Jul 17, 2025
High 7.5

CVE-2025-7472

A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a lo…

Sophos Sophos Intercept X for Windows Installer Windows Network devices

Jul 17, 2025
High 7.8

CVE-2024-13861

A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3…

Sophos Taegis Endpoint Agent (Linux) Linux Network devices

Apr 11, 2025
High 8.8

CVE-2024-12729

A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Soph…

Sophos Sophos Firewall Network devices

Dec 19, 2024
Critical 9.8

CVE-2024-12728

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than vers…

Sophos Sophos Firewall Network devices

Dec 19, 2024
Critical 9.8

CVE-2024-12727

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 …

Sophos Sophos Firewall Network devices

Dec 19, 2024
High 8.8

CVE-2024-8885

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 an…

Sophos Sophos Intercept X Network devices

Oct 2, 2024
Medium 4.7

CVE-2021-36806

A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sopho…

Sophos Sophos Email Appliance Network devices

Nov 30, 2023
High 7.1

CVE-2023-5552

A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to…

Sophos Sophos Firewall Network devices

Oct 17, 2023
Medium 6.5

CVE-2020-36692

A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows …

Sophos Sophos Web Appliance Network devices

Apr 4, 2023
Critical 9.8

CVE-2023-1671 Exploited Public exploit Scanner template EPSS 100%

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.1…

Sophos Sophos Web Appliance Network devices

Apr 4, 2023
KEV Nov 16, 2023
High 7.2

CVE-2022-4934

A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4…

Sophos Sophos Web Appliance Network devices

Apr 4, 2023
Low 3.3

CVE-2022-4901

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the lo…

Sophos Sophos Connect Client Network devices

Mar 1, 2023
Medium 5.5

CVE-2022-48310

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in S…

Sophos Sophos Connect Client Network devices

Mar 1, 2023
Medium 4.3

CVE-2022-48309

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versio…

Sophos Sophos Connect Client Network devices

Mar 1, 2023
Medium 4.3

CVE-2022-3711

A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in…

Sophos Sophos Firewall Network devices

Dec 1, 2022
High 8.8

CVE-2022-3713

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall rele…

Sophos Sophos Firewall Network devices

Dec 1, 2022
High 7.2

CVE-2022-3696

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older th…

Sophos Sophos Firewall Network devices

Dec 1, 2022
High 7.2

CVE-2022-3226

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewal…

Sophos Sophos Firewall Network devices

Dec 1, 2022
Low 2.7

CVE-2022-3710

A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database conte…

Sophos Sophos Firewall Network devices

Dec 1, 2022
Medium 6.8

CVE-2022-3709

A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Soph…

Sophos Sophos Firewall Network devices

Dec 1, 2022
Critical 9.8

CVE-2022-3980 Scanner template

An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in So…

Sophos Sophos Mobile managed on-premises Network devices

Nov 16, 2022
Critical 9.8

CVE-2022-3236 Exploited Scanner template EPSS 99%

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firew…

Sophos Sophos Firewall Network devices

Sep 23, 2022
KEV Sep 23, 2022
High 7.2

CVE-2022-1807

Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall o…

Sophos Sophos Firewall Network devices

Sep 7, 2022
High 8.4

CVE-2021-25268

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Fir…

Sophos Sophos Firewall Network devices

May 5, 2022
Medium 6.8

CVE-2021-25267

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall ol…

Sophos Sophos Firewall Network devices

May 5, 2022
Low 3.9

CVE-2021-25266

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys fro…

Sophos Sophos Authenticator (Android) Intercept X for Mobile (Android) Android Network devices

Apr 27, 2022
Medium 5.3

CVE-2022-0331

An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial…

Sophos Sophos Firewall Network devices

Mar 29, 2022
Critical 9.8

CVE-2022-1040 Exploited Public exploit Scanner template EPSS 100%

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…

Sophos Sophos Firewall Network devices

Mar 25, 2022
KEV Mar 31, 2022
Low 3.3

CVE-2022-0652

Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. T…

Sophos Sophos UTM Network devices

Mar 21, 2022
High 8.8

CVE-2022-0386

A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute cod…

Sophos Sophos UTM Network devices

Mar 21, 2022

Sophos

Sophos at a glance

Most common weaknesses

Products

Latest advisories

zlib: Schwachstelle ermöglicht nicht spezifizierten Angriff

Sophos Unified Threat Management (UTM) Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

zlib: Schwachstelle ermöglicht Codeausführung

Sophos Endpoint für macOS: Schwachstelle ermöglicht Privilegieneskalation und Ausführen von beliebigem Programmcode mit Administratorrechten

OpenSSL: Mehrere Schwachstellen

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM…

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS…

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series W…

A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potent…

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lea…

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adja…

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (…

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than…

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and …

A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024…

A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a lo…

A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3…

A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Soph…

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than vers…

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 …

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 an…

A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sopho…

A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to…

A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows …

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.1…

A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4…

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the lo…

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in S…

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versio…

A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in…

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall rele…

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older th…

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewal…

A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database conte…

A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Soph…

An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in So…

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firew…

Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall o…

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Fir…

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall ol…

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys fro…

An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial…

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…

Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. T…

A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute cod…