CVE-2026-118633

48th percentile - higher than 48% of all known CVEs

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.

Full compromise of the edge device by an unauthenticated attacker is possible, potentially leading to compromise of the entire network. Lack of vendor support increases the risk of prolonged exposure.

Manually install the available patch or urgently plan migration from the end-of-life Sophos UTM to a supported solution. Until migration, limit email proxy exposure and monitor for attack attempts.