Sophos UTM (all versions; end-of-life): pre-auth path traversal lets a remote attacker run commands as root when the email proxy is used with scanning enabled (CVE-2026-118633, Sophos: Critical); the patch must be installed manually
Sophos published an advisory on 28 October 2026, rated Critical, for CVE-2026-118633, a path traversal vulnerability in Sophos UTM reported through its bug bounty program by external researcher Sam Pizzey.
Sophos says the fix prevents an unauthenticated remote adversary from executing arbitrary commands with root privileges after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled.
Sophos says all versions of Sophos UTM are affected, that UTM is end-of-life and the patch must be installed manually, and that urgent customer action is required: customers still using Email Protection features on UTM should apply the patch as soon as possible. Sophos lists no workaround and recommends upgrading to a supported version of Sophos Firewall. Sophos's CVE record scores the flaw 9.2 (CVSS 4.0, Critical) and 8.1 (CVSS 3.1, High) and lists SG UTM versions up to and including 9.724 as affected.
The advisory does not mention exploitation. (source: Sophos)
- Product
- Sophos UTM (SG UTM), email proxy with scanning enabled
- Versions
- Affected (Sophos, as of 29 Oct): Sophos UTM, all versions (CVE record: SG UTM up to and including 9.724). Fix: a manually installed patch (Sophos KBA-000049692); Sophos also advises upgrading to a supported version of Sophos Firewall.
- CVSS
- (CVSS 4.0, Sophos CNA; Critical); 8.1 (CVSS 3.1, Sophos CNA; High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Exploited in Australia?
- unknown
- Patch to
- Install the manual UTM patch following Sophos's instructions in KBA-000049692 (https://support.sophos.com/support/s/article/KBA-000049692?language=en_US), as soon as possible if you still use UTM Email Protection; UTM is end-of-life, so plan the move to a supported version of Sophos Firewall, which is the remediation Sophos lists.