Sophos Firewall and UTM
CVE-2024-12727: Pre-auth SQL injection in Sophos Firewall
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Sophos Firewall 0 | 21.0 MR1 (21.0.1) or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.