Sophos Firewall Code Injection Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2022-3236 · Published 23/09/2022 · updated 17/06/2026

Sophos Firewall Code Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 23/09/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
firewall sophos	`≤ 19.0.1`	No fix yet

Description

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

References

sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2022-3236

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free