Sophos
154 CVEs across 97 Sophos products. Browse Sophos vulnerabilities, severities, and proof-of-concept exploits.
Sophos products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18367 | Critical | 9.3 | 2026-08-06 | A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos… |
CVE-2025-10159 | Critical | 9.8 | 2025-09-09 | An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmwar… |
CVE-2025-7624 | Critical | 9.8 | 2025-07-21 | An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code executio… |
CVE-2025-7382 | High | 8.8 | 2025-07-21 | A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code e… |
CVE-2025-6704 | Critical | 9.8 | 2025-07-21 | An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth… |
CVE-2024-13974 | High | 8.1 | 2025-07-21 | A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’… |
CVE-2024-13973 | Medium | 6.8 | 2025-07-21 | A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving a… |
CVE-2025-7433 | High | 8.8 | 2025-07-17 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution. |
CVE-2025-7472 | High | 7.5 | 2025-07-17 | A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges… |
CVE-2024-13972 | High | 8.8 | 2025-07-17 | A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SY… |
CVE-2024-13861 | High | 7.8 | 2025-04-11 | A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code ex… |
CVE-2024-12729 | High | 8.8 | 2024-12-19 | A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1… |
CVE-2024-12728 | Critical | 9.8 | 2024-12-19 | A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). |
CVE-2024-12727 | Critical | 9.8 | 2024-12-19 | A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting… |
CVE-2024-8885 | High | 8.8 | 2024-10-02 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary file… |
CVE-2021-36806 | Medium | 4.7 | 2023-11-30 | A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than versio… |
CVE-2023-5552 | High | 7.1 | 2023-10-18 | A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version… |
CVE-2023-33335 | Medium | 6.1 | 2023-07-05 | Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed. |
CVE-2023-33336 | Medium | 4.8 | 2023-06-30 | Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double… |
CVE-2023-1671 | Critical | 9.8 | 2023-04-04 | A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. |
CVE-2022-4934 | High | 7.2 | 2023-04-04 | A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitr… |
CVE-2020-36692 | Medium | 6.5 | 2023-04-04 | A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the vict… |
CVE-2022-4901 | Low | 3.3 | 2023-03-01 | Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration… |
CVE-2022-48310 | Medium | 5.5 | 2023-03-01 | An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90. |
CVE-2022-48309 | Medium | 4.3 | 2023-03-01 | A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90. |
CVE-2022-3713 | High | 8.8 | 2022-12-01 | A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3711 | Medium | 4.3 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall rele… |
CVE-2022-3710 | Low | 2.7 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Fire… |
CVE-2022-3709 | Medium | 6.8 | 2022-12-01 | A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version… |
CVE-2022-3696 | High | 7.2 | 2022-12-01 | A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3226 | High | 7.2 | 2022-12-01 | An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3980 | Critical | 9.8 | 2022-11-16 | An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between… |
CVE-2022-3236 | Critical | 9.8 | 2022-09-23 | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. |
CVE-2022-1807 | High | 7.2 | 2022-09-07 | Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 1… |
CVE-2021-25268 | High | 8.4 | 2022-05-05 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. |
CVE-2021-25267 | Medium | 6.8 | 2022-05-05 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. |
CVE-2021-25266 | Low | 3.9 | 2022-04-27 | An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticato… |
CVE-2022-0331 | Medium | 5.3 | 2022-03-29 | An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5… |
CVE-2022-1040 | Critical | 9.8 | 2022-03-25 | An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. |
CVE-2022-0652 | Low | 3.3 | 2022-03-22 | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt o… |
CVE-2022-0386 | High | 8.8 | 2022-03-22 | A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710. |
CVE-2021-36809 | Medium | 6.1 | 2022-03-08 | A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service… |
CVE-2021-36807 | High | 8.8 | 2021-11-26 | An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8. |
CVE-2021-25269 | Medium | 4.4 | 2021-11-26 | A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component… |
CVE-2021-36808 | Medium | 5.9 | 2021-10-30 | A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115. |
CVE-2021-25271 | Medium | 6.0 | 2021-10-08 | A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318. |
CVE-2021-25270 | Medium | 6.7 | 2021-10-08 | A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901. |
CVE-2021-25273 | Medium | 4.8 | 2021-07-29 | Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. |
CVE-2021-25264 | Medium | 6.7 | 2021-05-17 | In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges. |
CVE-2021-25265 | High | 8.8 | 2021-03-22 | A malicious website could execute code remotely in Sophos Connect Client before version 2.1. |
CVE-2020-29574 | Critical | 9.8 | 2020-12-11 | An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely. |
CVE-2020-25223 | Critical | 9.8 | 2020-09-25 | A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 |
CVE-2020-17352 | High | 8.8 | 2020-08-07 | Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely ex… |
CVE-2020-15504 | Critical | 9.8 | 2020-07-10 | A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary co… |
CVE-2020-15069 | Critical | 9.8 | 2020-06-29 | Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF… |
CVE-2020-14980 | Medium | 5.9 | 2020-06-22 | The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation. |
CVE-2020-11503 | Critical | 9.8 | 2020-06-18 | A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run arbitrary code remot… |
CVE-2020-12271 | Critical | 9.8 | 2020-04-27 | A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. Thi… |
CVE-2020-10947 | High | 8.8 | 2020-04-17 | Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation. |
CVE-2020-9540 | High | 7.8 | 2020-03-02 | Sophos HitmanPro.Alert before build 861 allows local elevation of privilege. |
CVE-2020-9363 | High | 7.8 | 2020-02-24 | The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile… |
CVE-2019-17059 | Critical | 9.8 | 2019-10-11 | A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary comma… |
CVE-2018-16118 | High | 8.1 | 2019-06-20 | A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execu… |
CVE-2018-16117 | High | 8.8 | 2019-06-20 | A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitr… |
CVE-2018-16116 | High | 8.8 | 2019-06-20 | SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQ… |
CVE-2017-17023 | High | 8.1 | 2019-04-09 | The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11… |
CVE-2018-3971 | High | 7.8 | 2018-10-25 | An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP re… |
CVE-2018-3970 | Medium | 5.5 | 2018-10-25 | An exploitable memory disclosure vulnerability exists in the 0x222000 IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP… |
CVE-2018-6857 | High | 7.8 | 2018-07-09 | Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via… |
CVE-2018-6856 | High | 7.8 | 2018-07-09 | Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via… |
CVE-2018-6855 | High | 7.8 | 2018-07-09 | Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via… |
CVE-2018-6854 | High | 7.8 | 2018-07-09 | Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via… |
CVE-2018-6853 | High | 7.8 | 2018-07-09 | Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via… |
CVE-2018-6852 | High | 7.8 | 2018-07-09 | Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via… |
CVE-2018-6851 | High | 7.8 | 2018-07-09 | Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via… |
CVE-2016-9038 | High | 7.8 | 2018-04-24 | An exploitable double fetch vulnerability exists in the SboxDrv.sys driver functionality of Invincea-X 6.1.3-24058. A specially crafted input buffer and race c… |
CVE-2016-8732 | High | 7.8 | 2018-04-24 | Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303. Weak restrictions on the driver communica… |
CVE-2018-9233 | High | 7.8 | 2018-04-05 | Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it e… |
CVE-2018-4863 | Medium | 5.5 | 2018-04-05 | Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSe… |
CVE-2018-6319 | Medium | 5.5 | 2018-02-02 | In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. This argument is a memory address: if a… |
CVE-2018-6318 | High | 7.8 | 2018-02-02 | In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using a payload that run… |
CVE-2016-6217 | Medium | 6.1 | 2018-01-26 | Cross-site scripting (XSS) vulnerability in Sophos PureMessage for UNIX before 6.3.2 allows remote attackers to inject arbitrary web script or HTML via unspeci… |
CVE-2017-18014 | Medium | 6.1 | 2018-01-12 | An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent X… |
CVE-2017-6315 | Critical | 9.8 | 2017-09-19 | Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx. |
CVE-2017-7441 | High | 7.8 | 2017-09-13 | In Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean), a crafted IOCTL with code 0x22E1C0 might lea… |
CVE-2017-6008 | High | 7.8 | 2017-09-13 | A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos… |
CVE-2017-6007 | Medium | 5.5 | 2017-09-13 | A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos… |
CVE-2012-6706 | Critical | 9.8 | 2017-06-22 | A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, tha… |
CVE-2017-9523 | Medium | 6.1 | 2017-06-09 | The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342. |
CVE-2016-9834 | Medium | 6.1 | 2017-06-07 | An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall devices with firmw… |
CVE-2016-7786 | High | 8.8 | 2017-04-07 | Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via direct object reference, as demonstrated b… |
CVE-2017-6412 | High | 8.1 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310. |
CVE-2017-6184 | Medium | 4.7 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injectio… |
CVE-2017-6183 | High | 7.2 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulner… |
CVE-2017-6182 | Critical | 9.8 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injectio… |
CVE-2016-9554 | High | 7.2 | 2017-01-28 | The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrati… |
CVE-2016-9553 | High | 7.2 | 2017-01-28 | The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vuln… |
CVE-2016-7442 | Medium | 4.4 | 2016-10-03 | The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "val… |
CVE-2016-7397 | Medium | 4.4 | 2016-10-03 | The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "val… |
CVE-2016-6597 | High | 8.6 | 2016-08-10 | Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the bac… |