Sophos vulnerabilities7 known to be exploited.
Sophos has 162 published vulnerabilities across 74 products in our catalogue. 7 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Sophos Anti-Virus, with 36. If you run Sophos software, patch the exploited flaws first.
The most recent Sophos flaw added to the known-exploited list is CVE-2020-29574, on 6 February 2025. We keep watching the known-exploited list.
Which Sophos products have the most vulnerabilities?
Sophos Anti-Virus leads with 36 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Sophos vulnerabilities are being exploited?
7 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8CyberoamOS (CROS) SQL Injection Vulnerability
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
- 9.8Sophos XG Firewall Buffer Overflow Vulnerability
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.
- 9.8Sophos Web Appliance Command Injection Vulnerability
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
- 9.8Sophos Firewall Code Injection Vulnerability
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
- 9.8Sophos Firewall Authentication Bypass Vulnerability
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
- 9.8Sophos SG UTM Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
- 9.8Sophos SFOS SQL Injection Vulnerability
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone.
Which Sophos flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
- >99%
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
- 99%
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
All Sophos products we track.
60 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Sophos Anti-Virussophos_anti-virus36 vulnerabilities53 versions
- Web Applianceweb_appliance18 vulnerabilities140 versions
- Anti-Virusanti-virus12 vulnerabilities48 versions
- Sophos Puremessage Anti-Virussophos_puremessage_anti-virus9 vulnerabilities1 version
- Unified Threat Management Softwareunified_threat_management_software9 vulnerabilities11 versions
- Xg Firewall Firmwarexg_firewall_firmware9 vulnerabilities3 versions
- Safeguard Easy Device Encryption Clientsafeguard_easy_device_encryption_client8 vulnerabilities6 versions
- Sfossfos8 vulnerabilities9 versions
- Sophos Small Business Suitesophos_small_business_suite8 vulnerabilities1 version
- Safeguard Enterprise Clientsafeguard_enterprise_client7 vulnerabilities6 versions
- Safeguard LAN Crypt Clientsafeguard_lan_crypt_client7 vulnerabilities3 versions
- Unified Threat Managementunified_threat_management7 vulnerabilities33 versions
- Firewallfirewall6 vulnerabilities4 versions
- Web Appliance Firmwareweb_appliance_firmware6 vulnerabilities79 versions
- Hitmanprohitmanpro4 vulnerabilities3 versions
- Hitmanpro.alerthitmanpro.alert4 vulnerabilities3 versions
- Scanning Enginescanning_engine4 vulnerabilities2 versions
- Endpoint Protectionendpoint_protection3 vulnerabilities2 versions
- Firewall Firmwarefirewall_firmware3 vulnerabilities1 version
- Puremessage for Microsoft Exchangepuremessage_for_microsoft_exchange3 vulnerabilities1 version
- Small Business Suitesmall_business_suite3 vulnerabilities2 versions
- Cyberoamoscyberoamos2 vulnerabilities7 versions
- Email Applianceemail_appliance2 vulnerabilities4 versions
- Es1000es10002 vulnerabilities1 version
This directory lists the 60 Sophos products with at least one tracked version, of 74 in our catalogue.
Running Sophos? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.
- Matched to
- Cyberoam on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 162 published vulnerabilities across 74 products and 667 versions from Sophos. The most recent Sophos flaw added to the known-exploited list is CVE-2020-29574, on 6 February 2025.
7 Sophos vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2020-29574, CVE-2020-15069 and CVE-2023-1671. The full list is on this page.
Sophos Anti-Virus, with 36 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Sophos products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.