{"id":"CVE-2026-118633","kind":"vulnerability","aliases":["CVE-2026-118633"],"related":[],"title":"Sophos UTM: path traversal lets unauthenticated remote attackers run code as root","description":"A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.","summary":"A path traversal flaw in Sophos UTM (all versions) lets a remote unauthenticated attacker win a race condition and execute arbitrary code as root when the email proxy runs with scanning enabled. Sophos UTM is end-of-life, so the fix must be applied manually.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-security","firewall","infrastructure","self-hosted","sophos-utm"],"not_affected_if":["email-proxy-disabled","scanning-disabled"],"how_to_check":"- Check whether the Sophos UTM appliance is running and which version it is on, using the appliance web admin console.\n- Check whether the email proxy is enabled with scanning turned on in the UTM configuration.","fix":"- Install the manual patch from Sophos for UTM, since the product is end-of-life and has no automatic update.\n- If no patch can be applied, disable the email proxy or its scanning feature, or replace the appliance: unknown whether the sources name a specific workaround.","status":"open","published_at":"2026-10-28T19:17:31+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:35:42+00:00","updated_at":"2026-10-28T19:35:42+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-28T19:35:42Z","model":"claude-haiku-5-5","output":{"fix":"- Install the manual patch from Sophos for UTM, since the product is end-of-life and has no automatic update.\n- If no patch can be applied, disable the email proxy or its scanning feature, or replace the appliance: unknown whether the sources name a specific workaround.","reach":"internet","title":"Sophos UTM: path traversal lets unauthenticated remote attackers run code as root","impact":"high","summary":"A path traversal flaw in Sophos UTM (all versions) lets a remote unauthenticated attacker win a race condition and execute arbitrary code as root when the email proxy runs with scanning enabled. Sophos UTM is end-of-life, so the fix must be applied manually.","category":"infrastructure","nicknames":[],"who_cares":["sophos-utm","firewall","self-hosted","email-security"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker gets root code execution on the firewall appliance","analyst_note":"Find the Sophos advisory and the manual patch steps and version list; the sources do not give a fixed version or a detection method.","how_to_check":"- Check whether the Sophos UTM appliance is running and which version it is on, using the appliance web admin console.\n- Check whether the email proxy is enabled with scanning turned on in the UTM configuration.","needs_analyst":true,"not_affected_if":["email-proxy-disabled","scanning-disabled"],"who_is_affected":"Organisations running Sophos UTM appliances with the email proxy and scanning enabled are exposed, and every UTM version is listed as affected. Appliances without the email proxy or with scanning disabled are not exposed according to the description. The sources do not say whether the attack succeeds reliably or what exact configuration beyond the email proxy is required.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000654,"input_tokens":3333,"output_tokens":642,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-118633':15A,18A '-2026':14A,17A 'allow':80C 'appli':74B 'arbitrari':50B,87C 'attack':8A,43B,84C,104C 'code':10A,51B,88C 'condit':47B,100C 'cve':13A,16A 'email':20B,56B,111C 'email-secur':19B 'enabl':61B,117C 'end':66B,122C 'end-of-lif':65B,121C 'execut':49B,86C 'firewal':22B 'fix':71B 'flaw':33B 'host':26B 'infrastructur':23B 'instal':130C 'let':5A,39B 'life':68B,124C 'manual':75B,131C 'minut':108C 'must':72B,128C 'patch':127C 'path':3A,31B,77C 'proxi':57B,112C 'race':46B,99C 'remot':7A,41B,82C 'repeat':103C 'root':12A,53B,90C 'run':9A,58B 'scan':60B,116C 'secur':21B 'self':25B 'self-host':24B 'sopho':1A,28B,35B,62B,92C,118C 'sophos-utm':27B 'sustain':102C 'travers':4A,32B,78C 'unauthent':6A,42B,83C 'use':114C 'utm':2A,29B,36B,63B,93C,119C 'version':38B,95C 'vulner':79C 'win':44B,97C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Sophos UTM appliances with the email proxy and scanning enabled are exposed, and every UTM version is listed as affected. Appliances without the email proxy or with scanning disabled are not exposed according to the description. The sources do not say whether the attack succeeds reliably or what exact configuration beyond the email proxy is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-alert@sophos.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118633","severity":null,"published_at":"2026-10-28T19:17:31+00:00","modified_at":"2026-10-28T19:17:31+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}