{"meta":{"title":"KEV entries: Sophos","description":"All KEV entries for vendor Sophos.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":7,"vendor":"Sophos","entries":7,"shareOfCatalogPercent":0.4,"ransomwareKnown":2,"firstDateAdded":"2021-11-03","latestDateAdded":"2025-02-06","rank":37},"data":[{"cveID":"CVE-2020-29574","vendorProject":"Sophos","product":"CyberoamOS","vulnerabilityName":"CyberoamOS (CROS) SQL Injection Vulnerability","dateAdded":"2025-02-06","dueDate":"2025-02-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.","requiredAction":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","notes":"https://support.sophos.com/support/s/article/KBA-000007526 ; https://nvd.nist.gov/vuln/detail/CVE-2020-29574","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2020-29574"},{"cveID":"CVE-2020-15069","vendorProject":"Sophos","product":"XG Firewall","vulnerabilityName":"Sophos XG Firewall Buffer Overflow Vulnerability","dateAdded":"2025-02-06","dueDate":"2025-02-27","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-120"],"shortDescription":"Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the \"HTTP/S bookmark\" feature.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal ; https://nvd.nist.gov/vuln/detail/CVE-2020-15069","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2020-15069"},{"cveID":"CVE-2023-1671","vendorProject":"Sophos","product":"Web Appliance","vulnerabilityName":"Sophos Web Appliance Command Injection Vulnerability","dateAdded":"2023-11-16","dueDate":"2023-12-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce;  https://nvd.nist.gov/vuln/detail/CVE-2023-1671","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-1671"},{"cveID":"CVE-2022-3236","vendorProject":"Sophos","product":"Firewall","vulnerabilityName":"Sophos Firewall Code Injection Vulnerability","dateAdded":"2022-09-23","dueDate":"2022-10-14","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce;  https://nvd.nist.gov/vuln/detail/CVE-2022-3236","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-3236"},{"cveID":"CVE-2022-1040","vendorProject":"Sophos","product":"Firewall","vulnerabilityName":"Sophos Firewall Authentication Bypass Vulnerability","dateAdded":"2022-03-31","dueDate":"2022-04-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-158"],"shortDescription":"An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-1040","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-1040"},{"cveID":"CVE-2020-25223","vendorProject":"Sophos","product":"SG UTM","vulnerabilityName":"Sophos SG UTM Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-25223","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-25223"},{"cveID":"CVE-2020-12271","vendorProject":"Sophos","product":"SFOS","vulnerabilityName":"Sophos SFOS SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-12271","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-12271"}]}