{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sophos-utm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sophos:utm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-118633"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Sophos UTM"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","sophos"],"_cs_type":"advisory","_cs_vendors":["Sophos"],"content_html":"\u003cp\u003eA path traversal vulnerability combined with a race condition in the Sophos UTM email proxy allows a remote unauthenticated attacker to execute arbitrary code as root. Successful exploitation requires sustaining repeated attacks for several minutes while the email proxy is used with scanning enabled. Sophos UTM is end-of-life, and patches must be applied manually. A Proof of Concept (PoC) exploit has been published on Sploitus.\u003c/p\u003e\n","date_modified":"2026-10-28T23:37:00Z","date_published":"2026-10-28T23:37:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sophos-utm-rce/","summary":"A path traversal and race condition vulnerability exists in the Sophos UTM email proxy, allowing unauthenticated remote attackers to execute arbitrary code as root.","title":"Sophos UTM: Unauthenticated Remote Code Execution (CVE-2026-118633)","url":"https://feed.craftedsignal.io/briefs/2026-10-sophos-utm-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Sophos UTM","version":"https://jsonfeed.org/version/1.1"}