Zero Radar
← feed
CriticalVulnerabilityupdated 29 Oct 2026, 14:04 UTC

Sophos UTM: remote attackers can run code as administrator

Sophos UTM is a security appliance that sits between your network and the internet. A flaw lets an anonymous outsider take full control of it without logging in.

No fix yetOfficial source
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or account needed
  2. 2Sends crafted requestTargets the UTM software over the network
  3. 3Flaw triggeredUTM runs attacker's code
  4. 4Admin rights gainedCode runs with administrator privileges
  5. ResultAttacker controls the Sophos UTM appliance

What happened

A vulnerability in Sophos Unified Threat Management (UTM) software allows a remote, unauthenticated attacker to execute arbitrary code with administrator privileges.

Why it is dangerous: An attacker gaining admin rights on the firewall/UTM could control network traffic, reach internal systems, and disable protections. Organizations running this software exposed to the internet are at risk.

Are you affected?

You are affected if you run Sophos Unified Threat Management (UTM) software on your network.

Sophos Unified Threat Management (UTM) software; exact versions unknown

What to do

  1. Check whether Sophos UTM is deployed in your environment and identify all instances
  2. Restrict external access to the UTM administration and services as far as possible
  3. Monitor for unusual administrative activity and watch the vendor and CERT-Bund for an official patch

Timeline

  1. 29 Oct 2026, 13:59 UTC
    Publicly disclosed
  2. 29 Oct 2026, 13:59 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 29 Oct 2026, 14:04 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-193fbd16
Disclosed
29 Oct 2026, 13:59 UTC
On Zero Radar
29 Oct 2026, 14:04 UTC (5 min after disclosure)
Last change
29 Oct 2026, 14:04 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Sophos UTM: remote attackers can run code as administrator · Zero Radar