Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118633updated 28 Oct 2026, 22:42 UTC

Sophos UTM: unauthenticated remote takeover via path traversal

An outsider can send crafted traffic to the firewall and run commands with full administrator rights. The attack has to be repeated for a few minutes before it works, but the result is complete control of the device.

Partial fixOfficial, 2 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?PartlyNot for every affected version · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or credentials needed
  2. 2Repeated requestsSustained for a few minutes
  3. 3Path traversalRace condition lets the request escape its directory
  4. 4Code executionRuns with root privileges
  5. ResultAttacker gains root control of the firewall

What happened

A path traversal flaw in Sophos UTM (all versions) lets an unauthenticated remote attacker execute arbitrary code as root when the email proxy with scanning is enabled, by winning a race condition through sustained repeated attacks.

Why it is dangerous: Successful exploitation gives the attacker root control of the firewall or gateway, which can expose the internal network and everything behind it. Organizations still running Sophos UTM with email scanning enabled are at risk.

Are you affected?

You are affected if you run Sophos UTM (any version) with the email proxy and scanning enabled.

Sophos UTM, all versions

What to do

  1. Check whether the email proxy with scanning is enabled on your Sophos UTM and disable it if you do not need it
  2. Install the manual patch from Sophos, since UTM is end-of-life and does not update automatically
  3. Plan a migration to a supported firewall platform, as no further vendor updates are expected

Timeline

  1. 28 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 19:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 22:42 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 22:42 UTC
    A fix was published

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118633 · GHSA-rwwg-8wpm-rm27
CVSS
9.2 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
28 Oct 2026, 19:17 UTC
On Zero Radar
28 Oct 2026, 19:17 UTC (0 min after disclosure)
Last change
28 Oct 2026, 22:42 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Sophos UTM: unauthenticated remote takeover via path traversal · Zero Radar