High severity · published Oct 28, 2026
CVE-2026-118633
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining…
New
8.1
CVSS
–
EPSS
No
On KEV
Description
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
SG UTM · Sophos
through 9.724 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118633
www.sophos.com
https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce
More from SG UTM
9.8
CVE-2020-25223
Sophos SG UTM Remote Code Execution Vulnerability