Live › vulnerability › CVE-2026-118633
Go to dashboardA path traversal flaw in Sophos UTM (all versions) lets a remote unauthenticated attacker win a race condition and execute arbitrary code as root when the email proxy runs with scanning enabled. Sophos UTM is end-of-life, so the fix must be applied manually.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Organisations running Sophos UTM appliances with the email proxy and scanning enabled are exposed, and every UTM version is listed as affected. Appliances without the email proxy or with scanning disabled are not exposed according to the description. The sources do not say whether the attack succeeds reliably or what exact configuration beyond the email proxy is required.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
This page as .md · .json · in your agent: get_signal("CVE-2026-118633")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.