Sophos Firewall and UTM
CVE-2022-3236: Firewall Code Injection
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Published
ExploitedYes, in CISA KEVAdded 23 Sept 2022
Ransomware useNot reportedPer CISA
SeverityCRITICALCVSS 3.1 9.8
EPSS99%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Sophos Firewall unspecified to 18.5 MR4 | Upgrade past 18.5 MR4; see the advisory |
| Sophos Firewall unspecified to 19.0 MR1 | Upgrade past 19.0 MR1; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Exploitation
CISA lists this CVE as exploited in the wild since 23 Sept 2022.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.