Sophos Firewall and UTM
CVE-2025-7624: SQL injection in Sophos Firewall
An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Sophos Firewall 0 | 21.0 MR2 (21.0.2) or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.