Critical

Resolved Pre-Auth RCE Vulnerability in Sophos UTM (CVE-2026-118633)

CVE(S)

CVE-2026-118633

PRODUCT(S)

Sophos UTM

Updated

2026 Oct 28

Article Version

First Published

2026 Oct 28

Publication ID

sophos-sa-20261028-utm-rce

Workaround

Overview

A path traversal vulnerability in Sophos UTM was recently discovered and responsibly disclosed to Sophos. It was reported via the Sophos bug bounty program by an external security researcher. The vulnerability has been fixed.

Sophos would like to thank Sam Pizzey for responsibly disclosing this issue to Sophos.

The remediation prevents an unauthenticated remote adversary from executing arbitrary commands with root privileges after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled.

Urgent customer action is required. Sophos UTM is end-of-life and the patch must be installed manually. Customers still using Email Protection features on UTM should apply the patch as soon as possible.

Applies to the following Sophos product(s) and version(s)

Sophos UTM (all versions)

Remediation

Upgrade to a supported version of Sophos Firewall
Follow the patch installation instructions at https://support.sophos.com/support/s/article/KBA-000049692?language=en_US

Related Information

Sophos Responsible Disclosure Policy

To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.