{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Sophos vulnerabilities","home_page_url":"https://patchfirst.co/vendor/sophos/","feed_url":"https://patchfirst.co/feed/vendor/sophos.json","description":"New and newly exploited Sophos CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2020-29574#kev","url":"https://patchfirst.co/cve/CVE-2020-29574/","title":"[KEV] CVE-2020-29574: CyberoamOS (CROS) SQL Injection Vulnerability","content_text":"Sophos · CyberoamOS. In CISA KEV since 2025-02-06, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.7% (higher than 91.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter. Priority 73.2 of 100.","summary":"CyberoamOS (CROS) SQL Injection Vulnerability","date_published":"2025-02-06T00:00:00.000Z","date_modified":"2026-08-15T04:17:56.000Z","tags":["kev","ransomware","T1055","T1059"],"_patchfirst":{"reason":"kev","priority":73.2,"kev":{"dateAdded":"2025-02-06","ransomware":true},"epss":{"score":0.04696,"percentile":0.91787},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"CyberoamOS","techniqueIds":["T1055","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-15069#kev","url":"https://patchfirst.co/cve/CVE-2020-15069/","title":"[KEV] CVE-2020-15069: Sophos XG Firewall Buffer Overflow Vulnerability","content_text":"Sophos · XG Firewall. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 10.7% (higher than 95.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 64.0 of 100.","summary":"Sophos XG Firewall Buffer Overflow Vulnerability","date_published":"2025-02-06T00:00:00.000Z","date_modified":"2026-06-17T02:55:59.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":64,"kev":{"dateAdded":"2025-02-06","ransomware":false},"epss":{"score":0.10674,"percentile":0.95799},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"XG Firewall","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-1671#kev","url":"https://patchfirst.co/cve/CVE-2023-1671/","title":"[KEV] CVE-2023-1671: Sophos Web Appliance Command Injection Vulnerability","content_text":"Sophos · Web Appliance. In CISA KEV since 2023-11-16. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.","summary":"Sophos Web Appliance Command Injection Vulnerability","date_published":"2023-11-16T00:00:00.000Z","date_modified":"2026-06-17T05:28:29.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2023-11-16","ransomware":false},"epss":{"score":0.99999,"percentile":0.99991},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"Web Appliance","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-3980","url":"https://patchfirst.co/cve/CVE-2022-3980/","title":"CVE-2022-3980: An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in…","content_text":"Sophos · Sophos Mobile managed on-premises. Not in CISA KEV. EPSS 9.8% (higher than 95.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 66.0 of 100.","summary":"An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in…","date_published":"2022-11-16T00:00:00.000Z","date_modified":"2025-04-29T14:12:08.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66,"kev":null,"epss":{"score":0.09785,"percentile":0.95533},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"Sophos Mobile managed on-premises","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-3236#kev","url":"https://patchfirst.co/cve/CVE-2022-3236/","title":"[KEV] CVE-2022-3236: Sophos Firewall Code Injection Vulnerability","content_text":"Sophos · Firewall. In CISA KEV since 2022-09-23. ENISA EUVD lists it as exploited. EPSS 98.9% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.","summary":"Sophos Firewall Code Injection Vulnerability","date_published":"2022-09-23T00:00:00.000Z","date_modified":"2026-06-17T04:59:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2022-09-23","ransomware":false},"epss":{"score":0.98905,"percentile":0.99927},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"Firewall","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-1040#kev","url":"https://patchfirst.co/cve/CVE-2022-1040/","title":"[KEV] CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability","content_text":"Sophos · Firewall. In CISA KEV since 2022-03-31. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle; T1574 Hijack Execution Flow. Priority 79.9 of 100.","summary":"Sophos Firewall Authentication Bypass Vulnerability","date_published":"2022-03-31T00:00:00.000Z","date_modified":"2026-06-17T04:21:42.000Z","tags":["kev","public-exploit","T1190","T1059","T1040","T1078","T1557","T1574"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-03-31","ransomware":false},"epss":{"score":0.99796,"percentile":0.99957},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"Firewall","techniqueIds":["T1190","T1059","T1040","T1078","T1557","T1574"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-25223#kev","url":"https://patchfirst.co/cve/CVE-2020-25223/","title":"[KEV] CVE-2020-25223: Sophos SG UTM Remote Code Execution Vulnerability","content_text":"Sophos · SG UTM. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 96.8% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.","summary":"Sophos SG UTM Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T03:06:37.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.96753,"percentile":0.99886},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"SG UTM","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-12271#kev","url":"https://patchfirst.co/cve/CVE-2020-12271/","title":"[KEV] CVE-2020-12271: Sophos SFOS SQL Injection Vulnerability","content_text":"Sophos · SFOS. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 42.4% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.6 of 100.","summary":"Sophos SFOS SQL Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:51:32.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.6,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.42434,"percentile":0.98702},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Sophos","product":"SFOS","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}