https://vulnogram.org/ Most recent CVEs assigned by Sophos Limited (sophos). https://vulnogram.org/seaview/icons/sophos.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-18367 https://vulnogram.org/CVE-2026-18367 A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6. Critical Thu, 06 Aug 2026 20:30:39 GMT https://vulnogram.org/CVE-2025-10159 https://vulnogram.org/CVE-2025-10159 An authentication bypass vulnerability allows remote attackers to gain administrative privileges on Sophos AP6 Series Wireless Access Points older than firmware version 1.7.2563 (MR7). Critical Network Exploitable Tue, 09 Sep 2025 20:58:26 GMT https://vulnogram.org/CVE-2024-13973 https://vulnogram.org/CVE-2024-13973 A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution. Medium Mon, 21 Jul 2025 13:38:22 GMT https://vulnogram.org/CVE-2024-13974 https://vulnogram.org/CVE-2024-13974 A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution. High Network Exploitable Mon, 21 Jul 2025 13:34:11 GMT https://vulnogram.org/CVE-2025-7382 https://vulnogram.org/CVE-2025-7382 A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP authentication for the admin u… High Mon, 21 Jul 2025 13:28:38 GMT https://vulnogram.org/CVE-2025-7624 https://vulnogram.org/CVE-2025-7624 An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older… Critical Network Exploitable Mon, 21 Jul 2025 13:24:37 GMT https://vulnogram.org/CVE-2025-6704 https://vulnogram.org/CVE-2025-6704 An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with th… Critical Network Exploitable Mon, 21 Jul 2025 13:16:29 GMT https://vulnogram.org/CVE-2025-7433 https://vulnogram.org/CVE-2025-7433 A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution. High Thu, 17 Jul 2025 19:10:27 GMT https://vulnogram.org/CVE-2024-13972 https://vulnogram.org/CVE-2024-13972 A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SYSTEM level privileges during a product upgrade. High Thu, 17 Jul 2025 19:02:36 GMT https://vulnogram.org/CVE-2025-7472 https://vulnogram.org/CVE-2025-7472 A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM. High Thu, 17 Jul 2025 18:53:29 GMT https://vulnogram.org/CVE-2024-13861 https://vulnogram.org/CVE-2024-13861 A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code execution as root. Redhat-based systems using RPM packages are not affected. High Fri, 11 Apr 2025 12:41:45 GMT https://vulnogram.org/CVE-2024-12729 https://vulnogram.org/CVE-2024-12729 A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1). High Thu, 19 Dec 2024 20:58:52 GMT https://vulnogram.org/CVE-2024-12728 https://vulnogram.org/CVE-2024-12728 A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). Critical Network Exploitable Thu, 19 Dec 2024 20:48:53 GMT https://vulnogram.org/CVE-2024-12727 https://vulnogram.org/CVE-2024-12727 A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eX… Critical Network Exploitable Thu, 19 Dec 2024 20:26:59 GMT https://vulnogram.org/CVE-2024-8885 https://vulnogram.org/CVE-2024-8885 A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files. High Wed, 02 Oct 2024 12:25:18 GMT https://vulnogram.org/CVE-2021-36806 https://vulnogram.org/CVE-2021-36806 A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than version 4.5.3.4. Medium Network Exploitable Thu, 30 Nov 2023 09:41:31 GMT https://vulnogram.org/CVE-2023-5552 https://vulnogram.org/CVE-2023-5552 A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”. High Tue, 17 Oct 2023 23:29:12 GMT https://vulnogram.org/CVE-2023-1671 https://vulnogram.org/CVE-2023-1671 A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. Critical Known Exploited Network Exploitable Tue, 04 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-4934 https://vulnogram.org/CVE-2022-4934 A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code. High Tue, 04 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2020-36692 https://vulnogram.org/CVE-2020-36692 A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that must be manually submitted by the victim while logged… Medium Network Exploitable Tue, 04 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-4901 https://vulnogram.org/CVE-2022-4901 Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim. Low Wed, 01 Mar 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-48310 https://vulnogram.org/CVE-2022-48310 An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90. Medium Wed, 01 Mar 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-48309 https://vulnogram.org/CVE-2022-48309 A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90. Medium Network Exploitable Wed, 01 Mar 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-3713 https://vulnogram.org/CVE-2022-3713 A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. High Thu, 01 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-3711 https://vulnogram.org/CVE-2022-3711 A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA. Medium Thu, 01 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-3710 https://vulnogram.org/CVE-2022-3710 A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA. Low Thu, 01 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-3709 https://vulnogram.org/CVE-2022-3709 A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA. Medium Thu, 01 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-3696 https://vulnogram.org/CVE-2022-3696 A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. High Thu, 01 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-3226 https://vulnogram.org/CVE-2022-3226 An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. High Thu, 01 Dec 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-3980 https://vulnogram.org/CVE-2022-3980 An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4. Critical Network Exploitable Wed, 16 Nov 2022 00:00:00 GMT https://vulnogram.org/CVE-2022-3236 https://vulnogram.org/CVE-2022-3236 A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. Critical Known Exploited Network Exploitable Fri, 23 Sep 2022 12:50:13 GMT https://vulnogram.org/CVE-2022-1807 https://vulnogram.org/CVE-2022-1807 Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1. High Wed, 07 Sep 2022 18:00:14 GMT https://vulnogram.org/CVE-2021-25268 https://vulnogram.org/CVE-2021-25268 Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. High Thu, 05 May 2022 18:05:13 GMT https://vulnogram.org/CVE-2021-25267 https://vulnogram.org/CVE-2021-25267 Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. Medium Thu, 05 May 2022 18:05:12 GMT https://vulnogram.org/CVE-2021-25266 https://vulnogram.org/CVE-2021-25266 An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.… Low Wed, 27 Apr 2022 16:45:13 GMT https://vulnogram.org/CVE-2022-0331 https://vulnogram.org/CVE-2022-0331 An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older. Medium Network Exploitable Tue, 29 Mar 2022 00:30:13 GMT https://vulnogram.org/CVE-2022-1040 https://vulnogram.org/CVE-2022-1040 An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. Critical Known Exploited Network Exploitable Fri, 25 Mar 2022 12:10:10 GMT https://vulnogram.org/CVE-2022-0652 https://vulnogram.org/CVE-2022-0652 Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.71… Low Mon, 21 Mar 2022 23:45:15 GMT https://vulnogram.org/CVE-2022-0386 https://vulnogram.org/CVE-2022-0386 A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710. High Mon, 21 Mar 2022 23:45:14 GMT https://vulnogram.org/CVE-2021-36809 https://vulnogram.org/CVE-2021-36809 A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client. Medium Mon, 07 Mar 2022 23:45:11 GMT https://vulnogram.org/CVE-2022-0366 https://vulnogram.org/CVE-2022-0366 An authenticated and authorized agent user could potentially gain administrative access via an SQLi vulnerability to Capsule8 Console between versions 4.6.0 and 4.9.1. High Wed, 02 Feb 2022 11:31:20 GMT https://vulnogram.org/CVE-2021-36807 https://vulnogram.org/CVE-2021-36807 An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8. High Fri, 26 Nov 2021 14:12:47 GMT https://vulnogram.org/CVE-2021-25269 https://vulnogram.org/CVE-2021-25269 A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2… Medium Fri, 26 Nov 2021 14:12:47 GMT https://vulnogram.org/CVE-2021-36808 https://vulnogram.org/CVE-2021-36808 A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115. Medium Sat, 30 Oct 2021 12:22:27 GMT https://vulnogram.org/CVE-2021-25271 https://vulnogram.org/CVE-2021-25271 A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318. Thu, 07 Oct 2021 23:11:54 GMT https://vulnogram.org/CVE-2021-25270 https://vulnogram.org/CVE-2021-25270 A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901. Thu, 07 Oct 2021 23:11:53 GMT https://vulnogram.org/CVE-2021-25273 https://vulnogram.org/CVE-2021-25273 Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. Thu, 29 Jul 2021 19:17:34 GMT https://vulnogram.org/CVE-2021-25264 https://vulnogram.org/CVE-2021-25264 In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges. Mon, 17 May 2021 17:02:09 GMT https://vulnogram.org/CVE-2021-25265 https://vulnogram.org/CVE-2021-25265 A malicious website could execute code remotely in Sophos Connect Client before version 2.1. Mon, 22 Mar 2021 17:24:28 GMT