{"id":"CVE-2022-3236","published":"2022-09-23T13:15:10Z","modified":"2026-06-17T04:59:07Z","title":"Sophos Firewall Code Injection Vulnerability","vendor":"Sophos","product":"Firewall","tier":"core","eol":null,"description":{"text":"A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.","provenance":"source","from":"NVD"},"summary":{"text":"A code injection flaw in the User Portal and Webadmin components of Sophos Firewall lets an attacker run arbitrary code on affected devices. The attack needs only network access to the firewall's management interfaces, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:43:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98905,"percentile":0.99927,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-09-23","dueDate":"2022-10-14","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce;  https://nvd.nist.gov/vuln/detail/CVE-2022-3236","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-09-16","exploitedFirstSeen":"2022-09-16","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2022-09-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-09-23"},{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce","date":"2022-09-23"},{"url":"https://www.mandiant.com/resources/blog/zero-days-exploited-2022","date":"2023-03-20"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2023-1107.pdf","date":"2023-11-07"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a","date":"2024-09-05"},{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/","date":"2024-10-31"},{"url":"https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/","date":"2024-10-31"},{"url":"https://www.cisa.gov/sites/default/files/2024-11/aa24-317a-2023-top-routinely-exploited-vulnerabilities.pdf","date":"2024-11-12"},{"url":"https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/2023-top-routinely-exploited-vulnerabilities","date":"2024-11-13"}],"evidenceTotal":21,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce","tags":["Vendor Advisory"]},{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote attacker exploits public-facing web interfaces","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A code injection vulnerability in the User Portal and Webadmin allows a remote attacker","start":0,"end":87}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Injected code executes on firewall","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows a remote attacker to execute code in Sophos Firewall","start":63,"end":122}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-cb049733b1fc717427aa","title":"Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure","publisher":"cisa.gov","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf","date":null,"mentions":[{"quote":" CVE-2022-3236 (Sophos: Firewall)","start":10469,"end":10503},{"quote":"Group G1003 - Ember Bear\r\n MITRE: Impacket\r\n NIST NVD: CVE-2020-1472\r\n NIST NVD: CVE-2021-26084\r\n NIST NVD: CVE-2021-3156\r\n NIST NVD: CVE-2021-4034\r\n NIST NVD: CVE-2022-27666\r\n NIST NVD: CVE-2021-33044\r\n NIST NVD: CVE-2021-33045\r\n NIST NVD: CVE-2022-26134\r\n NIST NVD: CVE-2022-26138\r\n NIST NVD: CVE-2022-3236","start":36809,"end":37128}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-42644","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42644","exploited":true,"exploitedSince":"2022-09-23","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2022-3236","name":"Sophos Firewall <= 19.0 MR1 - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-3236.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3236.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2022-09-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2022-09-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3236","provenance":"source"},{"date":"2022-09-23","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-09-23","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42644","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1504 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-sophos-firewall-cwe-94"}}