Sophos known exploited vulnerabilities
Every Sophos CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 7 in all, 0 added in the last 12 months.
- CVE-2020-29574An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL s
- CVE-2020-15069Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientles
- CVE-2023-1671A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution Sophos Web Appliance
- CVE-2022-3236A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1Sophos Firewall
- CVE-2022-1040An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version vSophos Firewall
- CVE-2020-25223A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
- CVE-2020-12271A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many Sophos vulnerabilities are in CISA KEV?
7 Sophos vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months. The newest is CVE-2020-29574 (CyberoamOS (CROS) SQL Injection Vulnerability), added 2025-02-06.
Which Sophos products are in CISA KEV?
6 products, including CyberoamOS, XG Firewall, Web Appliance. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Sophos KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 2 of the 7 Sophos entries.