Sophos - vulnerabilities (CVEs)
176 CVEs in 97 products, 1 in the last 30 days, newest from 2026-10-28.
Products
- Sophos Anti-virus - 35 CVEs
- Sophos Firewall - 21 CVEs
- Anti-virus - 12 CVEs
- Web Appliance - 12 CVEs
- Firewall Firmware - 10 CVEs
- Sophos Puremessage Anti-virus - 9 CVEs
- Unified Threat Management Software - 9 CVEs
- Xg Firewall Firmware - 9 CVEs
- Safeguard Easy Device Encryption Client - 8 CVEs
- Sfos - 8 CVEs
- Sophos Small Business Suite - 8 CVEs
- Safeguard Enterprise Client - 7 CVEs
- Safeguard Lan Crypt Client - 7 CVEs
- Web Appliance Firmware - 6 CVEs
- Connect - 4 CVEs
- Hitmanpro - 4 CVEs
- Hitmanpro.alert - 4 CVEs
- Scanning Engine - 4 CVEs
- Sophos Connect Client - 4 CVEs
- Unified Threat Management - 4 CVEs
- Endpoint Protection - 3 CVEs
- Endpoint Security - 3 CVEs
- Intercept X - 3 CVEs
- Puremessage For Microsoft Exchange - 3 CVEs
- Small Business Suite - 3 CVEs
- Sophos Utm - 3 CVEs
- Sophos Web Appliance - 3 CVEs
- Anti-virus7.6.3 - 2 CVEs
- Cyberoamos - 2 CVEs
- Es1000 - 2 CVEs
- Es4000 - 2 CVEs
- Firewall - 2 CVEs
- Intercept X Endpoint - 2 CVEs
- Intercept X For Server - 2 CVEs
- Mobile - 2 CVEs
- Sg Utm - 2 CVEs
- Sophos Tester - 2 CVEs
- Unified Threat Management Up2date - 2 CVEs
- Anti-virus For Sophos Central - 1 CVEs
- Anti-virus For Sophos Home - 1 CVEs
- Ap6 Series Wireless Access Points - 1 CVEs
- Astaro Security Gateway Firmware - 1 CVEs
- Astaro Security Linux - 1 CVEs
- Authenticator - 1 CVEs
- Cloud Optix - 1 CVEs
- Cyberoam Cr100ing Utm Firmware - 1 CVEs
- Cyberoam Cr25ing Utm Firmware - 1 CVEs
- Cyberoam Cr35ing Utm Firmware - 1 CVEs
- Cyberoam Firmware - 1 CVEs
- Disk Encryption - 1 CVEs
- Email Appliance - 1 CVEs
- Enterprise Console - 1 CVEs
- Exploit Prevention - 1 CVEs
- Free Encryption - 1 CVEs
- Home - 1 CVEs
- Intercept X Advanced - 1 CVEs
- Intercept X Advanced For Server - 1 CVEs
- Intercept X For Macos - 1 CVEs
- Intercept X For Macos Opm - 1 CVEs
- Intercept X For Mobile Android - 1 CVEs
- Invincea-x - 1 CVEs
- Invincea Dell Protected Workspace - 1 CVEs
- Ipsec Client - 1 CVEs
- Iview - 1 CVEs
- Mobile Control Eas Proxy - 1 CVEs
- Puremessage - 1 CVEs
- Safeguard Enterprise - 1 CVEs
- Safeguard Enterprise Device Encryption - 1 CVEs
- Safeguard Privatecrypto - 1 CVEs
- Secure Web Gateway - 1 CVEs
- Sophos Authenticator Android - 1 CVEs
- Sophos Email Appliance - 1 CVEs
- Sophos Endpoint For Macos - 1 CVEs
- Sophos Endpoint Security And Control - 1 CVEs
- Sophos Exploit Prevention - 1 CVEs
- Sophos Home For Macos - 1 CVEs
- Sophos Intercept X - 1 CVEs
- Sophos Intercept X For Windows - 1 CVEs
- Sophos Intercept X For Windows Core Agent - 1 CVEs
- Sophos Intercept X For Windows Installer - 1 CVEs
- Sophos Mailmonitor - 1 CVEs
- Sophos Mailmonitor For Notes Domino - 1 CVEs
- Sophos Mobile Managed On-premises - 1 CVEs
- Sophos Secure Email - 1 CVEs
- Sophos Secure Workspace - 1 CVEs
- Sophos Secure Workspace For Android - 1 CVEs
- Ssl Vpn Client - 1 CVEs
- Taegis Endpoint Agent - 1 CVEs
- Taegis Endpoint Agent Linux - 1 CVEs
- Threat Detection Engine - 1 CVEs
- Astaro Security Gateway - 0 CVEs
- Cyberoam - 0 CVEs
- Cyberoam Cr100ing Utm - 0 CVEs
- Cyberoam Cr25ing Utm - 0 CVEs
- Cyberoam Cr35ing Utm - 0 CVEs
- United Threat Management - 0 CVEs
- Xg Firewall - 0 CVEs
Newest CVEs of Sophos
- CVE-2026-118633 - CVSS 9.2 (critical), 2026-10-28: A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race…
- CVE-2026-18367 - CVSS 9.3 (critical), 2026-08-06: A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos…
- CVE-2025-10159 - CVSS 9.8 (critical), 2025-09-09: An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than…
- CVE-2009-10005 - CVSS 8.7 (high), 2025-08-20: ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing…
- CVE-2025-7624 - CVSS 9.8 (critical), 2025-07-21: An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code…
- CVE-2025-7382 - CVSS 8.8 (high), 2025-07-21: A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code…
- CVE-2025-6704 - CVSS 9.8 (critical), 2025-07-21: An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth…
- CVE-2024-13974 - CVSS 8.1 (high), 2025-07-21: A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the…
- CVE-2024-13973 - CVSS 7.2 (high), 2025-07-21: A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving…
- CVE-2025-7433 - CVSS 8.8 (high), 2025-07-17: A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.
- CVE-2025-7472 - CVSS 7.5 (high), 2025-07-17: A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level…
- CVE-2024-13972 - CVSS 8.8 (high), 2025-07-17: A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining…
- CVE-2024-13861 - CVSS 7.8 (high), 2025-04-11: A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code…
- CVE-2024-12728 - CVSS 9.8 (critical), 2024-12-19: A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).
- CVE-2024-12727 - CVSS 9.8 (critical), 2024-12-19: A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting…
- CVE-2024-12729 - CVSS 8.8 (high), 2024-12-19: A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1…
- CVE-2024-8885 - CVSS 8.8 (high), 2024-10-02: A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary…
- CVE-2021-36806 - CVSS 6.1 (medium), 2023-11-30: A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than version…
- CVE-2023-5552 - CVSS 7.5 (high), 2023-10-18: A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall…
- CVE-2023-33335 - CVSS 6.1 (medium), 2023-07-05: Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.
- CVE-2023-33336 - CVSS 4.8 (medium), 2023-06-30: Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the…
- CVE-2020-36692 - CVSS 6.5 (medium), 2023-04-04: A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the…
- CVE-2023-1671 - CVSS 9.8 (critical), 2023-04-04: A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
- CVE-2022-4934 - CVSS 7.2 (high), 2023-04-04: A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute…
- CVE-2022-48309 - CVSS 4.3 (medium), 2023-03-01: A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.
- CVE-2022-4901 - CVSS 6.1 (medium), 2023-03-01: Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN…
- CVE-2022-48310 - CVSS 5.5 (medium), 2023-03-01: An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.
- CVE-2022-3226 - CVSS 7.2 (high), 2022-12-01: An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.
- CVE-2022-3710 - CVSS 2.7 (low), 2022-12-01: A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos…
- CVE-2022-3709 - CVSS 8.4 (high), 2022-12-01: A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version…
