Vendor dossier / #37
Sophos vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 7 Sophos vulnerabilities as of catalog 2026.09.23, 0.4% of all 1,721 entries and rank 37 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2025-02-06; 2 are flagged as used in ransomware campaigns.
- KEV entries
- 70.4% of catalog
- Last 90 days
- +0added
- Ransomware: known
- 228.6%
- Products
- 6distinct
- First added
- 2021-11-03
- Latest added
- 2025-02-06
- Median days to due
- 21
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 1 |
| 2022 | 3 |
| 2023 | 1 |
| 2024 | 0 |
| 2025 | 2 |
| 2026 | 0 |
QCommon questions
How many Sophos vulnerabilities are in CISA KEV?
7, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 0.4% of the catalog.
Which Sophos product has the most KEV entries?
Firewall, with 2 entries. 6 products appear in total.
How many Sophos KEV vulnerabilities are linked to ransomware?
2 of 7 (28.6%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest Sophos vulnerability added to KEV?
2025-02-06 (CVE-2020-29574).
What is the most common weakness in Sophos KEV entries?
CWE-89 (SQL injection), listed on 2 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Firewall | 2 | 28.6% |
| CyberoamOS | 1 | 14.3% |
| XG Firewall | 1 | 14.3% |
| Web Appliance | 1 | 14.3% |
| SG UTM | 1 | 14.3% |
| SFOS | 1 | 14.3% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-89 SQL injection | 2 | 28.6% |
| CWE-120 Classic buffer overflow | 1 | 14.3% |
| CWE-77 Command injection | 1 | 14.3% |
| CWE-94 Code injection | 1 | 14.3% |
| CWE-158 | 1 | 14.3% |
| CWE-78 OS command injection | 1 | 14.3% |
EAll 7 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2020-29574 | CyberoamOS | CyberoamOS (CROS) SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2020-15069 | XG Firewall | Sophos XG Firewall Buffer Overflow Vulnerability | Unknown | CWE-120 | ||
| CVE-2023-1671 | Web Appliance | Sophos Web Appliance Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2022-3236 | Firewall | Sophos Firewall Code Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2022-1040 | Firewall | Sophos Firewall Authentication Bypass Vulnerability | Unknown | CWE-158 | ||
| CVE-2020-25223 | SG UTM | Sophos SG UTM Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-12271 | SFOS | Sophos SFOS SQL Injection Vulnerability | Known | CWE-89 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 7 Sophos vulnerabilities (0.4% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/sophos/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Sophos beyond this data.