Vendor
Sophos vulnerabilities
50 advisories tracked, 7 exploited in the wild according to CISA, 1 published in 2026.
Data refreshed 13 Oct 2026
Patch now
Exploited in the last two years (CISA KEV), or a 10%+ chance of exploitation in the next 30 days (EPSS).
CVE-2024-13973Sophos Firewall and UTM
Post-auth SQL injection in Sophos FirewallCVE-2020-29574Sophos Firewall and UTM
CyberoamOS (CROS) SQL InjectionCVE-2020-15069Sophos Firewall and UTM
XG Firewall Buffer Overflow
Products covered
Select a product to see only its advisories.
All tracked advisories
Newest first. Full analysis marks the CVEs we've written up in depth; the rest link to an automatic summary.
| Published | CVE | Product | Issue | Severity | EPSS | Exploited |
|---|---|---|---|---|---|---|
| CVE-2026-18367 | Endpoint and Intercept X | Privilege escalation in Sophos Endpoint for macOS, Sophos Home for macOS | CRITICAL 9.3 | 0.18% | – | |
| CVE-2024-13973 | Sophos Firewall and UTM | Post-auth SQL injection in Sophos Firewall | MEDIUM 6.8 | 10% | – | |
| CVE-2024-13974 | Sophos Firewall and UTM | Business logic in Sophos Firewall | HIGH 8.1 | 7.7% | – | |
| CVE-2025-7382 | Sophos Firewall and UTM | Command injection in Sophos Firewall | HIGH 8.8 | 4.2% | – | |
| CVE-2025-7624 | Sophos Firewall and UTM | SQL injection in Sophos Firewall | CRITICAL 9.8 | 8.9% | – | |
| CVE-2025-6704 | Sophos Firewall and UTM | Arbitrary file writing in Sophos Firewall | CRITICAL 9.8 | 10.0% | – | |
| CVE-2025-7433 | Endpoint and Intercept X | Local privilege escalation in Sophos Intercept X for Windows | HIGH 8.8 | 0.11% | – | |
| CVE-2024-13972 | Endpoint and Intercept X | A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent… | HIGH 8.8 | 0.14% | – | |
| CVE-2025-7472 | Endpoint and Intercept X | Local privilege escalation in Sophos Intercept X for Windows Installer | HIGH 7.5 | 0.13% | – | |
| CVE-2024-13861 | Endpoint and Intercept X | Code injection in Taegis Endpoint Agent (Linux) | HIGH 7.8 | 0.20% | – | |
| CVE-2024-12729 | Sophos Firewall and UTM | Post-auth code injection in Sophos Firewall | HIGH 8.8 | 1.3% | – | |
| CVE-2024-12728 | Sophos Firewall and UTM | Weak credentials in Sophos Firewall | CRITICAL 9.8 | 0.94% | – | |
| CVE-2024-12727 | Sophos Firewall and UTM | Pre-auth SQL injection in Sophos Firewall | CRITICAL 9.8 | 1.4% | – | |
| CVE-2024-8885 | Endpoint and Intercept X | Local privilege escalation in Sophos Intercept X | HIGH 8.8 | 0.11% | – | |
| CVE-2021-36806 | Email and Web Appliance | Reflected XSS in Sophos Email Appliance | MEDIUM 4.7 | 0.43% | – | |
| CVE-2023-5552 | Sophos Firewall and UTM | Password disclosure in Sophos Firewall | HIGH 7.1 | 0.50% | – | |
| CVE-2023-1671 | Email and Web Appliance | Web Appliance Command Injection | CRITICAL 9.8 | 100% | Yes | |
| CVE-2020-36692 | Email and Web Appliance | Reflected XSS via POST in Sophos Web Appliance | MEDIUM 6.5 | 0.57% | – | |
| CVE-2022-4934 | Email and Web Appliance | Post-auth command injection in Sophos Web Appliance | HIGH 7.2 | 1.8% | – | |
| CVE-2022-48309 | Endpoint and Intercept X | A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Co… | MEDIUM 4.3 | 0.34% | – | |
| CVE-2022-48310 | Endpoint and Intercept X | Information disclosure in Sophos Connect Client | MEDIUM 5.5 | 0.13% | – | |
| CVE-2022-4901 | Endpoint and Intercept X | Multiple stored XSS in Sophos Connect Client | LOW 3.3 | 0.34% | – | |
| CVE-2022-3226 | Sophos Firewall and UTM | OS command injection in Sophos Firewall | HIGH 7.2 | 1.8% | – | |
| CVE-2022-3696 | Sophos Firewall and UTM | Post-auth code injection in Sophos Firewall | HIGH 7.2 | 1.2% | – | |
| CVE-2022-3709 | Sophos Firewall and UTM | Stored XSS in Sophos Firewall | MEDIUM 6.8 | 0.86% | – | |
| CVE-2022-3710 | Sophos Firewall and UTM | Post-auth read-only SQL injection in Sophos Firewall | LOW 2.7 | 0.75% | – | |
| CVE-2022-3711 | Sophos Firewall and UTM | Post-auth read-only SQL injection in Sophos Firewall | MEDIUM 4.3 | 0.75% | – | |
| CVE-2022-3713 | Sophos Firewall and UTM | Code injection in Sophos Firewall | HIGH 8.8 | 0.72% | – | |
| CVE-2022-3980 | Endpoint and Intercept X | XML External Entity (XEE) in Sophos Mobile managed on-premises | CRITICAL 9.8 | 8.9% | – | |
| CVE-2022-3236 | Sophos Firewall and UTM | Firewall Code Injection | CRITICAL 9.8 | 99% | Yes | |
| CVE-2022-1807 | Sophos Firewall and UTM | Multiple SQLi in Sophos Firewall | HIGH 7.2 | 1.1% | – | |
| CVE-2021-25268 | Sophos Firewall and UTM | Multiple XSS in Sophos Firewall | HIGH 8.4 | 0.91% | – | |
| CVE-2021-25267 | Sophos Firewall and UTM | Multiple XSS in Sophos Firewall | MEDIUM 6.8 | 1.1% | – | |
| CVE-2021-25266 | Endpoint and Intercept X | Insecure data storage in Intercept X for Mobile (Android), Sophos Authenticator (Android) | LOW 3.9 | 0.23% | – | |
| CVE-2022-0331 | Sophos Firewall and UTM | Information disclosure in Sophos Firewall | MEDIUM 5.3 | 1.5% | – | |
| CVE-2022-1040 | Sophos Firewall and UTM | Firewall Authentication Bypass | CRITICAL 9.8 | 100% | Yes | |
| CVE-2022-0652 | Sophos Firewall and UTM | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access pe… | LOW 3.3 | 0.19% | – | |
| CVE-2022-0386 | Sophos Firewall and UTM | Post-auth SQL injection in Sophos UTM | HIGH 8.8 | 1.2% | – | |
| CVE-2021-36809 | Endpoint and Intercept X | A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privi… | MEDIUM 6.1 | 0.23% | – | |
| CVE-2021-25269 | Endpoint and Intercept X | A local administrator could prevent the HMPA service from starting despite tamper protection using an unquo… | MEDIUM 4.4 | 0.25% | – | |
| CVE-2021-36807 | Sophos Firewall and UTM | Authenticated user could potentially execute code via an SQLi in SG UTM | HIGH 8.8 | 1.5% | – | |
| CVE-2021-25271 | Endpoint and Intercept X | A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before vers… | – | 0.23% | – | |
| CVE-2021-25270 | Endpoint and Intercept X | A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before versi… | – | 0.26% | – | |
| CVE-2021-25273 | Sophos Firewall and UTM | Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. | – | 0.83% | – | |
| CVE-2021-25264 | Endpoint and Intercept X | In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code w… | – | 0.31% | – | |
| CVE-2021-25265 | Endpoint and Intercept X | A malicious website could execute code remotely in Sophos Connect Client before version 2.1. | – | 2.0% | – | |
| CVE-2020-29574 | Sophos Firewall and UTM | CyberoamOS (CROS) SQL Injection | CRITICAL 9.8 | 4.7% | Yes · ransomware | |
| CVE-2020-25223 | Sophos Firewall and UTM | SG UTM Remote Code Execution | CRITICAL 9.8 | 97% | Yes | |
| CVE-2020-15069 | Sophos Firewall and UTM | XG Firewall Buffer Overflow | CRITICAL 9.8 | 11% | Yes | |
| CVE-2020-12271 | Sophos Firewall and UTM | SFOS SQL Injection | CRITICAL 10 | 42% | Yes · ransomware |
Sources: Sophos security advisories, CISA KEV and FIRST EPSS. Severity is the vendor's own rating.