{"id":"CVE-2022-1040","kind":"vulnerability","aliases":["CVE-2022-1040"],"related":[],"title":"Sophos Firewall: Sophos Firewall Authentication Bypass Vulnerability","description":"An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Sophos Firewall's User Portal and Webadmin have an authentication bypass that lets an unauthenticated attacker reach remote code execution. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":0.99796,"exploited":true,"exploited_at":"2022-03-31T00:00:00+00:00","products":[{"name":"Sophos Firewall","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Sophos Firewall","fixed":["18.5 MR4 (18.5.4)","19.0 GA"],"affected":"<= 18.5 MR3 (18.5.3) without the Mar 2022 hotfix","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","sophos-firewall"],"not_affected_if":["default-config","hotfix-auto-install-enabled","webadmin-not-wan-exposed"],"how_to_check":"Check firmware version in the Sophos Firewall web admin (v18.5 MR3/18.5.3 or older without the March 2022 hotfix is affected). Check whether User Portal or Webadmin is reachable from WAN (Device access / Administration > Device access, WAN zone). Check that 'Allow automatic installation of hotfixes' is on (default).","fix":"Upgrade to v18.5 MR4 (18.5.4) or v19.0 GA or later; or apply the March/April 2022 hotfix for your version (supported: v17.0 MR10 EAL4+, v17.5 MR16/MR17, v18.0 MR5/MR6, v18.5 MR1-MR3, v19.0 EAP). Workaround: disable WAN access to User Portal and Webadmin, use VPN or Sophos Fusion. Older EOL versions must upgrade.","status":"open","published_at":"2022-03-25T12:15:07+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:18:10+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T21:18:10Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates per Sophos instructions; the sources do not name the fixed version.","reach":"internet","impact":"high","summary":"Sophos Firewall's User Portal and Webadmin have an authentication bypass that lets an unauthenticated attacker reach remote code execution. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["sophos-firewall","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the firewall appliance","analyst_note":"Find the affected and fixed Sophos Firewall versions and a way to check exposure (User Portal/Webadmin exposed to WAN) in Sophos's advisory for CVE-2022-1040.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000453,"input_tokens":2819,"output_tokens":343,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed Sophos Firewall versions and a way to check exposure (User Portal/Webadmin exposed to WAN) in Sophos's advisory for CVE-2022-1040.","search":"'-1040':10A,13A '-2022':9A,12A 'action':74C 'activ':50B 'allow':67C 'appli':75C 'attack':41B 'authent':5A,35B,56C 'bypass':6A,36B,57C 'cisa':46B,72C 'code':44B,70C 'cve':8A,11A 'execut':45B,71C 'exploit':18B,51B 'firewal':2A,4A,25B,27B,66C 'firewall':15A,17A 'host':22B 'infrastructur':19B 'instruct':79C 'let':38B 'list':47B 'per':77C 'portal':30B,61C 'reach':42B 'remot':43B,69C 'requir':73C 'self':21B 'self-host':20B 'sopho':1A,3A,24B,26B,65C 'sophos':14A,16A 'sophos-firewal':23B 'unauthent':40B 'updat':76C 'user':29B,60C 'vendor':78C 'vulner':7A,58C 'webadmin':32B,63C 'wild':54B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-03-25T12:15:07+00:00","kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@sophos.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-1040","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-1040","severity":null,"published_at":"2022-03-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2022-1040","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-1040","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-1040:52","url":null,"severity":null,"published_at":"2026-10-23T21:18:37+00:00","modified_at":"2026-10-23T21:18:37+00:00","first_seen_at":"2026-10-23T21:18:37+00:00","fetched_at":"2026-10-23T21:18:37+00:00","note":"Read Sophos advisory sophos-sa-20220325-sfos-rce (primary). Affected v18.5 MR3 and older; fixed in 18.5 MR4 / 19.0 GA or hotfixes. Exploited per Sophos and KEV. PoC link not checked."},{"source":"nvd","external_id":"CVE-2022-1040","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1040","severity":null,"published_at":"2022-03-25T12:15:07+00:00","modified_at":"2026-06-17T04:21:42+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":939,"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce","title":"Sophos SA: Resolved RCE in Sophos Firewall (CVE-2022-1040)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}