---
id: "CVE-2022-1040"
kind: "vulnerability"
aliases: ["CVE-2022-1040"]
title: "Sophos Firewall: Sophos Firewall Authentication Bypass Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99796
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Sophos Firewall", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Sophos Firewall", "fixed": ["18.5 MR4 (18.5.4)", "19.0 GA"], "affected": "<= 18.5 MR3 (18.5.3) without the Mar 2022 hotfix", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "self-hosted", "sophos-firewall"]
not_affected_if: ["default-config", "hotfix-auto-install-enabled", "webadmin-not-wan-exposed"]
published_at: "2022-03-25T12:15:07+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-1040", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1040", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:18:37+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1040", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Sophos Firewall: Sophos Firewall Authentication Bypass Vulnerability

Sophos Firewall's User Portal and Webadmin have an authentication bypass that lets an unauthenticated attacker reach remote code execution. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Sophos Firewall affected ? fixed ?
- vendor:Sophos Firewall affected <= 18.5 MR3 (18.5.3) without the Mar 2022 hotfix fixed 18.5 MR4 (18.5.4), 19.0 GA

## How to check

Check firmware version in the Sophos Firewall web admin (v18.5 MR3/18.5.3 or older without the March 2022 hotfix is affected). Check whether User Portal or Webadmin is reachable from WAN (Device access / Administration > Device access, WAN zone). Check that 'Allow automatic installation of hotfixes' is on (default).

## Fix

Upgrade to v18.5 MR4 (18.5.4) or v19.0 GA or later; or apply the March/April 2022 hotfix for your version (supported: v17.0 MR10 EAL4+, v17.5 MR16/MR17, v18.0 MR5/MR6, v18.5 MR1-MR3, v19.0 EAP). Workaround: disable WAN access to User Portal and Webadmin, use VPN or Sophos Fusion. Older EOL versions must upgrade.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-1040
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-1040
- 2026-10-23T21:18:37+00:00 analyst — Read Sophos advisory sophos-sa-20220325-sfos-rce (primary). Affected v18.5 MR3 and older; fixed in 18.5 MR4 / 19.0 GA or hotfixes. Exploited per Sophos and KEV. PoC link not checked.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-1040

## Documents

- [advisory] Sophos SA: Resolved RCE in Sophos Firewall (CVE-2022-1040) https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce

## From the sources

An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_