Vendor

Sophos

7 of 8 Sophos CVEs in Patchfirst (88%) are in of vulnerabilities exploited in the wild, 2 of them used by ransomware.

CVEs: 8
In CISA KEV: 788%
Known ransomware use: 2
Median days to KEV: 546; from publication
Latest KEV listing: 6 Feb 2025

Watch Sophos Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Firewall In KEV: 2 CVEs: 2
CyberoamOS In KEV: 1 CVEs: 1
SFOS In KEV: 1 CVEs: 1
SG UTM In KEV: 1 CVEs: 1
Web Appliance In KEV: 1 CVEs: 1
XG Firewall In KEV: 1 CVEs: 1
Sophos Mobile managed on-premises In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Sophos CVEs

TechniqueCVEs
T1059Command and Scripting Interpreter CVEs: 7
T1190Exploit Public-Facing Application CVEs: 6
T1040Network Sniffing CVEs: 1
T1078Valid Accounts CVEs: 1
T1557Adversary-in-the-Middle CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/sophos.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Sophos CVEs linked to the technique. Each link’s provenance is on the CVE page.

Sophos CVEs

8 CVEs, by priority

CVE-2022-1040Sophos Firewall Authentication Bypass Vulnerability
Sophos · FirewallKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts+4 more
99.8%Top 0.04%
79.9priority
CVE-2020-12271Sophos SFOS SQL Injection Vulnerability
Sophos · SFOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
42.4%Top 1.3%
79.6priority
CVE-2022-3236Sophos Firewall Code Injection Vulnerability
Sophos · FirewallKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
98.9%Top 0.07%
73.7priority
CVE-2020-25223Sophos SG UTM Remote Code Execution Vulnerability
Sophos · SG UTMKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
96.8%Top 0.11%
73.7priority
CVE-2020-29574CyberoamOS (CROS) SQL Injection Vulnerability
Sophos · CyberoamOSKEVRansomwareCritical · 9.8T1059Command and Scripting Interpreter T1055Process Injection
4.7%Top 8.2%
73.2priority
CVE-2023-1671Sophos Web Appliance Command Injection Vulnerability
Sophos · Web ApplianceKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
>99.9%Top 0.01%
69.9priority
CVE-2022-3980An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in…
Sophos · Sophos Mobile managed on-premisesPublic exploitCritical · 9.8
9.8%Top 4.5%
66.0priority
CVE-2020-15069Sophos XG Firewall Buffer Overflow Vulnerability
Sophos · XG FirewallKEVCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
10.7%Top 4.2%
64.0priority