Vulnerabilities & Exploits
Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Versions of Sophos UTM
Sophos has disclosed a severe remote code execution flaw in its legacy Sophos UTM security gateway product. The vulnerability, tracked as CVE-2026-118633, carries a CVSS v4.0 base score of 9.2 and is rated Critical. It impacts the email proxy when scanning features are enabled, allowing unauthenticated attackers to achieve root-level command execution by triggering a race condition. Although the product has reached end-of-life status, Sophos has released a manual patch that administrators must apply themselves. The company strongly urges immediate remediation for any deployments still using the mail protection functionality and recommends migrating to the supported Sophos Firewall platform.
Security NEXTOct 29, 2026Translated from Japanese