Read the docs
TI-2026-82153 Aliases CVE-2026-118633GHSA-rwwg-8wpm-rm27

Path traversal in Sophos UTM lets remote attackers run code as root

Priority MEDIUM 43CWE-35Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Sophos SG UTM from 0 through 9.724 is affected. A path traversal flaw (CWE-35) lets a remote unauthenticated attacker run arbitrary code as root. The attacker must win a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SophosSG UTMup to 9.724—No fix listedCNA
  • SG UTM VendorSophos Affected up to 9.724 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for SG UTM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118633
  2. 2026-10-28 Alias added: GHSA-rwwg-8wpm-rm27
  3. 2026-11-05 CISA SSVC decision points changed

References

Other 1

  • TI-2023-01568 Command injection in Sophos Web Appliance KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-02989 Code injection in Sophos Firewall KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-00937 An authentication bypass vulnerability in the User Portal and Webadmin allows a remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-17763 An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-15463 A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-11847 Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code… KEVCVSS 3.1CRITICAL 9.8
See all 174 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences