Read the docs

Sophos

Records175All Threatist records
Exploited (KEV)7In CISA KEV
CVSS critical27CVSS 9.0–10.0
CVSS high69CVSS 7.0–8.9

Exploited now

Sophos records in CISA KEV
TI-2020-11847 Sophos XG Firewall Buffer Overflow Vulnerability Priority CRITICAL 100KEV 2025-02-06TI-2020-17763 CyberoamOS (CROS) SQL Injection Vulnerability Priority CRITICAL 100KEV 2025-02-06TI-2023-01568 Sophos Web Appliance Command Injection Vulnerability Priority CRITICAL 100KEV 2023-11-16TI-2022-02989 Sophos Firewall Code Injection Vulnerability Priority CRITICAL 100KEV 2022-09-23TI-2022-00937 Sophos Firewall Authentication Bypass Vulnerability Priority CRITICAL 100KEV 2022-03-31TI-2020-15463 Sophos SG UTM Remote Code Execution Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Sophos Anti-virus 35 records HIGH Web Appliance 17 records CRITICAL Anti-virus 12 records MEDIUM Firewall Firmware 10 records MEDIUM Sophos Puremessage Anti-virus 9 records HIGH Unified Threat Management Software 9 records HIGH Xg Firewall Firmware 9 records CRITICAL Safeguard Easy Device Encryption Client 8 records LOW

Records

10 records in Firewall Firmware · all components

TI-2025-06959 CVE-2025-7624 · GHSA-rjpf-qp74-8rgx

SQL injection in Sophos Firewall

Priority MEDIUM 62

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10514 Published 2025-07-21 Fixed in 21.0 MR2 (21.0.2) CWE-89
TI-2025-06088 CVE-2025-6704 · GHSA-5m7h-7mwc-924h

OS command injection in Sophos Firewall

Priority MEDIUM 62

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11772 Published 2025-07-21 Fixed in 21.0 MR2 (21.0.2) CWE-78
TI-2024-11800 CVE-2024-12727 · GHSA-vf9g-3qff-2rx6

SQL injection in Sophos Firewall

Priority MEDIUM 52

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01401 Published 2024-12-19 Fixed in 21.0 MR1 (21.0.1) CWE-89
TI-2024-12980 CVE-2024-13974 · GHSA-84xf-f99r-6prw

A business logic vulnerability in the Up2Date component of Sophos Firewall older than…

Priority MEDIUM 49

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.09069 Published 2025-07-21 Fixed in 21.0 MR1 (21.0.1) CWE-807
TI-2025-06724 CVE-2025-7382 · GHSA-848r-3x2j-g9jr

OS command injection in Sophos Firewall

Priority MEDIUM 48

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.04857 Published 2025-07-21 Fixed in 21.0 MR2 (21.0.2) CWE-78
TI-2024-12979 CVE-2024-13973 · GHSA-jfx3-jv8f-g222

SQL injection in Sophos Firewall

Priority MEDIUM 48

A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.12257 Published 2025-07-21 Fixed in 21.0 MR1 (21.0.1) CWE-89
TI-2024-11802 CVE-2024-12729 · GHSA-6r4g-xxf8-49wf

Code injection in Sophos Firewall

Priority MEDIUM 43

A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01306 Published 2024-12-19 Fixed in 21.0 MR1 (21.0.1) CWE-94
TI-2021-07519 CVE-2021-25267 · GHSA-5fg7-mh37-fjrv

Cross-site scripting in Sophos Firewall

Priority LOW 39

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.01093 Published 2022-05-05 Fixed in 19.0 GA CWE-79
TI-2021-07520 CVE-2021-25268 · GHSA-6gw9-fj88-98q3

Cross-site scripting in Sophos Firewall

Priority LOW 38

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00912 Published 2022-05-05 Fixed in 19.0 GA CWE-79
Open these records in search →