Critical9.2Sophos
CVE-2026-118633: path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled
This Sophos advisory covers CVE-2026-118633 in SG UTM.
- CVE-2026-118633
Key facts
- Vendor rating
- Critical, CVSS 9.2
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N· base score 9.2, scored by SophosAttack vector: network. Attack complexity: low. Attack requirements: present. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: high. Integrity impact on the vulnerable system: high. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: none. Integrity impact on subsequent systems: none. Availability impact on subsequent systems: none.- Weakness
- CWE-35 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
- EPSS
- 0.60% chance of exploitation in the next 30 days (48th percentile). FIRST EPSS, .
- CISA SSVC
- Exploitation: none observed. Automatable: no. Technical impact: total. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- SG UTM through 9.724
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
SophosUnclassified
Description
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
Affected product named by the advisory: SG UTM.
Text from the source record.
Affected versions
- SG UTM through 9.724
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-118633
Vendor guidance
- Sophos UTM is end-of-life and the patch must be installed manually.
More Sophos advisories
CVE-2026-98432Nov 2, 2026Linux Kernel TCP Vulnerability (CVE-2026-98432)CVE-2026-18367Aug 6, 2026privilege escalationCVE-2025-6704Jul 21, 2025arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of SophosCVE-2024-13973Jul 21, 2025post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions olderCVE-2024-13972Jul 17, 2025vulnerability related to registry permissions in the Intercept X for Windows updaterCVE-2023-5552Oct 18, 2023Sophos Firewall: password disclosure vulnerability in the Secure PDF eXchange (SPX)
Get an email when Sophos publishes the next one.
See Sophos's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.