Critical9.8Sophos

Sophos Mobile: XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in…

CVE-2022-3980 Published Nov 16, 2022Updated by vendor Jun 17, 2026

CVE-2022-3980

Affected products & platforms

SophosSophos Mobile / Connect

Summary

An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.

Mitigation

Mitigation steps weren't captured by the parser for this advisory — this is a parsing gap, not a statement that no fix exists. Read the vendor advisory below for the authoritative guidance.

Official advisory · medium-confidence parse· fetched 3 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.