Sophos Firewall and UTM
CVE-2022-1040: Firewall Authentication Bypass
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
Published
ExploitedYes, in CISA KEVAdded 31 Mar 2022
Ransomware useNot reportedPer CISA
SeverityCRITICALCVSS 3.1 9.8
EPSS100%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Sophos Firewall unspecified to 18.5 MR3 | Upgrade past 18.5 MR3; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
Exploitation
CISA lists this CVE as exploited in the wild since 31 Mar 2022.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.