# cve.now: Sophos

The newest entries naming Sophos as an affected vendor (up to 200), of 49 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118633](https://cve.now/CVE-2026-118633.md): A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions)… (CVSS 8.1)
- [CVE-2026-18367](https://cve.now/CVE-2026-18367.md): A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2 (CVSS 9.3)
- [CVE-2025-10159](https://cve.now/CVE-2025-10159.md): An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points (CVSS 9.8)
- [CVE-2024-13973](https://cve.now/CVE-2024-13973.md): A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to adminis (CVSS 6.8)
- [CVE-2024-13974](https://cve.now/CVE-2024-13974.md): A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers contro (CVSS 8.1)
- [CVE-2025-7382](https://cve.now/CVE-2025-7382.md): A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achiev (CVSS 8.8)
- [CVE-2025-7624](https://cve.now/CVE-2025-7624.md): An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to r (CVSS 9.8)
- [CVE-2025-6704](https://cve.now/CVE-2025-6704.md): An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) ca (CVSS 9.8)
- [CVE-2025-7433](https://cve.now/CVE-2025-7433.md): A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrar (CVSS 8.8)
- [CVE-2024-13972](https://cve.now/CVE-2024-13972.md): A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a lo (CVSS 8.8)
- [CVE-2025-7472](https://cve.now/CVE-2025-7472.md): A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining syst (CVSS 7.5)
- [CVE-2024-13861](https://cve.now/CVE-2024-13861.md): A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local user (CVSS 7.8)
- [CVE-2024-12729](https://cve.now/CVE-2024-12729.md): A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older tha (CVSS 8.8)
- [CVE-2024-12728](https://cve.now/CVE-2024-12728.md): A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3) (CVSS 9.8)
- [CVE-2024-12727](https://cve.now/CVE-2024-12727.md): A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows acces (CVSS 9.8)
- [CVE-2024-8885](https://cve.now/CVE-2024-8885.md): A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writin (CVSS 8.8)
- [CVE-2021-36806](https://cve.now/CVE-2021-36806.md): A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance (CVSS 4.7)
- [CVE-2023-5552](https://cve.now/CVE-2023-5552.md): A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Soph (CVSS 7.1)
- [CVE-2023-1671](https://cve.now/CVE-2023-1671.md): A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution (CVSS 9.8, KEV)
- [CVE-2022-4934](https://cve.now/CVE-2022-4934.md): A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrator (CVSS 7.2)
- [CVE-2020-36692](https://cve.now/CVE-2020-36692.md): A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScri (CVSS 6.5)
- [CVE-2022-4901](https://cve.now/CVE-2022-4901.md): Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a maliciou (CVSS 3.3)
- [CVE-2022-48310](https://cve.now/CVE-2022-48310.md): An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect version (CVSS 5.5)
- [CVE-2022-48309](https://cve.now/CVE-2022-48309.md): A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90. (CVSS 4.3)
- [CVE-2022-3713](https://cve.now/CVE-2022-3713.md): A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than versi (CVSS 8.8)
- [CVE-2022-3711](https://cve.now/CVE-2022-3711.md): A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of S (CVSS 4.3)
- [CVE-2022-3710](https://cve.now/CVE-2022-3710.md): A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API contro (CVSS 2.7)
- [CVE-2022-3709](https://cve.now/CVE-2022-3709.md): A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases (CVSS 6.8)
- [CVE-2022-3696](https://cve.now/CVE-2022-3696.md): A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. (CVSS 7.2)
- [CVE-2022-3226](https://cve.now/CVE-2022-3226.md): An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than (CVSS 7.2)
- [CVE-2022-3980](https://cve.now/CVE-2022-3980.md): An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed o (CVSS 9.8)
- [CVE-2022-3236](https://cve.now/CVE-2022-3236.md): A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 (CVSS 9.8, KEV)
- [CVE-2022-1807](https://cve.now/CVE-2022-1807.md): Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18. (CVSS 7.2)
- [CVE-2021-25268](https://cve.now/CVE-2021-25268.md): Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than vers (CVSS 8.4)
- [CVE-2021-25267](https://cve.now/CVE-2021-25267.md): Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 (CVSS 6.8)
- [CVE-2021-25266](https://cve.now/CVE-2021-25266.md): An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in (CVSS 3.9)
- [CVE-2022-0331](https://cve.now/CVE-2022-0331.md): An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Fir (CVSS 5.3)
- [CVE-2022-1040](https://cve.now/CVE-2022-1040.md): An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v (CVSS 9.8, KEV)
- [CVE-2022-0652](https://cve.now/CVE-2022-0652.md): Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. (CVSS 3.3)
- [CVE-2022-0386](https://cve.now/CVE-2022-0386.md): A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM befor (CVSS 8.8)
- [CVE-2021-36809](https://cve.now/CVE-2021-36809.md): A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a (CVSS 6.1)
- [CVE-2021-36807](https://cve.now/CVE-2021-36807.md): An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8. (CVSS 8.8)
- [CVE-2021-25269](https://cve.now/CVE-2021-25269.md): A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in (CVSS 4.4)
- [CVE-2021-36808](https://cve.now/CVE-2021-36808.md): A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115. (CVSS 5.9)
- [CVE-2021-25271](https://cve.now/CVE-2021-25271.md): A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318. (no CVSS)
- [CVE-2021-25270](https://cve.now/CVE-2021-25270.md): A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901. (no CVSS)
- [CVE-2021-25273](https://cve.now/CVE-2021-25273.md): Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. (no CVSS)
- [CVE-2021-25264](https://cve.now/CVE-2021-25264.md): In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges. (no CVSS)
- [CVE-2021-25265](https://cve.now/CVE-2021-25265.md): A malicious website could execute code remotely in Sophos Connect Client before version 2.1. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/sophos
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.