Sophos UTM: Pre-authentication path traversal leading to remote root code execution
Summary
A path traversal vulnerability in Sophos UTM, which is end-of-life, allows a remote unauthenticated attacker to execute arbitrary commands as root. The attack requires winning a race condition by sending repeated requests for a few minutes, and it applies when the email proxy with scanning is enabled. Sophos states that the fix must be installed manually.
Affected
- Sophos UTM (all versions) according to the vendor advisory
- Aggregators list a version ceiling of 9.724; this is unconfirmed and conflicts with the vendor statement
- Relevant configuration: email proxy with scanning enabled
Fixed in
- A fix is available according to Sophos, but the patch must be installed manually
- Patch instructions: KBA-000049692 (not verified by this tracker)
- Alternative: migrate to a supported Sophos Firewall version
Workaround
- Sophos publishes no workaround.
- Unverified third-party suggestions: disable the email proxy if not required, restrict access to trusted internal subnets, or place a WAF or IPS in front of the device (this filters traffic but does not remove the flaw).
Exploitation
- No confirmed exploitation in the wild; the CVE is not listed in the CISA KEV catalogue according to secondary sources.
- Public PoC: unclear; one Sploitus entry is unverified, and Vuldb reports no exploit available.
- No published indicators of compromise found.
Our recommendation
- Inventory all UTM devices and check whether the email proxy and scanning are enabled.
- Isolate or restrict the email proxy, especially if it is reachable from the internet.
- Apply the vendor patch manually once the KBA instructions are verified, or plan migration to a supported Sophos Firewall.
- Review logs for unusual or repeated email proxy requests until patched.
- Prioritise this issue using CVSS 4.0 score 9.2 (Critical).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Sophos Security Advisory SA-20261028-utm-rce www.sophos.com
- Vuldb CVE-2026-118633 vuldb.com
- Brandefense: Sophos UTM CVE-2026-118633 brandefense.io
- OffSeq Radar CVE-2026-118633 radar.offseq.com
- ThreatInt CVE-2026-118633 cve.threatint.com
- Strix CVE-2026-118633 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:56.
Original description (NVD)
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.