CVE-2026-118633: Path Traversal
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Sophos UTM deployments are exposed when the email proxy is in use with scanning enabled. The issue affects all Sophos UTM versions.
Does exploitation require authentication or user interaction?
No. A remote attacker does not need authentication or user interaction, but must win a race condition by sustaining repeated attacks for a few minutes.
What is the impact if exploitation succeeds?
Successful exploitation allows arbitrary code execution as root, with high confidentiality, integrity, and availability impact.
What should administrators do given that Sophos UTM is end-of-life?
Install the available patch manually. The provided advisory states that the product is end-of-life and that patch installation is not automatic.