critical9.2
CVE-2026-118633
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race con…
Impact
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sophos | SG UTM | Version 0 ≤9.724 |