CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Sophos SG UTM Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Affected products
sophos: unified threat management
References10
- community.sophos.com/b/security-blog Not ApplicableVendor Advisory
- community.sophos.com/b/security-blog/posts/advisory-resolved-rc… Vendor Advisory
- community.sophos.com/b/security-blog Not ApplicableVendor Advisory
- community.sophos.com/b/security-blog/posts/advisory-resolved-rc… Vendor Advisory
- packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Co… ExploitThird Party AdvisoryVDB Entry
- www.secpod.com/blog/remote-code-execution-in-sophos-utm/ ExploitThird Party Advisory
- packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Co… ExploitThird Party AdvisoryVDB Entry
- www.secpod.com/blog/remote-code-execution-in-sophos-utm/ ExploitThird Party Advisory
- cwe.mitre.org/data/definitions/78.html Technical Description
- cwe.mitre.org/data/definitions/78.html Technical Description
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 97% percentile: 100 · as of 2 November 2026
- CWE
- CWE-78