Sophos UTM: Unauthenticated Remote Code Execution (CVE-2026-118633)
A path traversal and race condition vulnerability exists in the Sophos UTM email proxy, allowing unauthenticated remote attackers to execute arbitrary code as root.
CVE search metadata
CVE search record: CVE-2026-118633. Severity: high. CVSS: 8.1. KEV: no. Product: Sophos UTM. Brief: Sophos UTM: Unauthenticated Remote Code Execution (CVE-2026-118633). Brief link: https://feed.craftedsignal.io/briefs/2026-10-sophos-utm-rce/
Triage facts
Revision 1- Applicability
- Sophos UTM
- Evidence
- Unknown
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 28, 23:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
A path traversal vulnerability combined with a race condition in the Sophos UTM email proxy allows a remote unauthenticated attacker to execute arbitrary code as root. Successful exploitation requires sustaining repeated attacks for several minutes while the email proxy is used with scanning enabled. Sophos UTM is end-of-life, and patches must be applied manually. A Proof of Concept (PoC) exploit has been published on Sploitus.