Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Sophos

Description

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sophos SG UTM

  • 0 to ≤ 9.724affected

References