Skip to content
VulniPulse

Sophos Security Advisories & CVEs

10 advisories tracked · Sophos (security-alert@sophos.com CNA) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence

Android app · Google Play

Monitor Sophos CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Check if your Sophos device is affected

Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Sophos's recent advisories.

Official source

Sophos (security-alert@sophos.com CNA) via NVD

Sophos is its own CVE Numbering Authority. VulniPulse ingests Sophos's CVEs from the NVD CNA feed (security-alert@sophos.com), each linking to its sophos.com advisory. Covers Sophos Firewall (XG/XGS, SFOS), Intercept X / Sophos Central endpoint, Sophos UTM, Sophos Mobile, Sophos Connect VPN and the Web/Email appliances — its firewalls are a repeated mass-exploitation target (the 'Pacific Rim' campaign), so an MSP-heavy, alert-hungry community.

Latest Sophos advisories

Critical9.3Sophos

Critical [CVE-2026-18367] privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.

CVE-2026-18367
Unclassified
Aug 6, 2026
Critical9.8Sophos

Critical [CVE-2025-10159] authentication bypass vulnerability

An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7).

CVE-2025-10159
Unclassified
Sep 9, 2025
Critical9.8Sophos

Critical [CVE-2025-7624] SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.

CVE-2025-7624
Sophos Firewall (XGS/SFOS)
Jul 21, 2025
Critical9.8Sophos

Critical [CVE-2025-6704] arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2…

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode.

CVE-2025-6704
Sophos Firewall (XGS/SFOS)
Jul 21, 2025
Critical9.8Sophos

Critical [CVE-2024-12728] Sophos Firewall: weak credentials vulnerability potentially allows privileged system access

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).

CVE-2024-12728
Sophos Firewall (XGS/SFOS)
Dec 19, 2024
Critical9.8Sophos

Critical [CVE-2024-12727] pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1)

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.

CVE-2024-12727
Sophos Firewall (XGS/SFOS)
Dec 19, 2024
Critical9.8Sophos Exploited CISA KEV

Critical [CVE-2023-1671] pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

CVE-2023-1671
Unclassified
Apr 4, 2023
Critical9.8Sophos

Critical [CVE-2022-3980] Sophos Mobile: XML External Entity (XEE) vulnerability

An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.

CVE-2022-3980
Sophos Mobile / Connect
Nov 16, 2022
Critical9.8Sophos Exploited CISA KEV

Critical [CVE-2022-3236] Sophos Firewall: code injection vulnerability in the User Portal and Webadmin

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

CVE-2022-3236
Sophos Firewall (XGS/SFOS)
Sep 23, 2022
Critical9.8Sophos Exploited CISA KEV

Critical [CVE-2022-1040] Sophos Firewall: authentication bypass vulnerability in the User Portal and Webadmin

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.

CVE-2022-1040
Sophos Firewall (XGS/SFOS)
Mar 25, 2022

← All vendors