Sophos Issues Manual Patch for UTM Pre-Auth Root RCE
Tech GuruQuick Answer
Sophos requires urgent action for CVE-2026-118633 in end-of-life UTM systems using Email Protection scanning. Inventory exposed appliances, preserve relevant evidence, install the manual patch or migrate, validate mail flow and administration, and retain proof of remediation.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory every Sophos UTM appliance, exact version, Email Protection and scanning state, public mail interfaces, HA role, owners, logging coverage, backups, and maintenance windows. Confirm that the UTM email proxy is used with scanning enabled; do not infer compromise from exposure alone, but treat sustained unsolicited traffic and process anomalies as reasons for incident review. Follow Sophos's linked manual patch instructions immediately or migrate to a supported Sophos Firewall version. Restrict unnecessary exposure and preserve evidence before disruptive cleanup when indicators exist. Confirm patch installation or migration state, test inbound and outbound mail, scanning, quarantine, administration and HA, review proxy and system logs for repeated attack patterns, and retain package and change evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Sophos UTM Email Protection proxy |
|---|---|
| Advisory | Sophos SA 20261028 UTM RCE |
| CVE | CVE-2026-118633 |
| Authoritative release date | 2026-10-28 18:45:59.892 UTC |
| Authority revision date | 2026-10-28 18:45:59.892 UTC |
| Affected versions | Sophos UTM all versions when the email proxy is used with scanning enabled; Sophos CNA data identifies SG UTM through 9.724. |
| Fixed version | Install Sophos's manual patch immediately or migrate to a supported Sophos Firewall release |
| CVSS base score | 9.2 (CVSS v4.0); 8.1 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Sophos says the issue was reported through its bug bounty program and does not state that it is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Sophos fixed a race-condition vulnerability that can let an unauthenticated remote attacker execute commands as root after sustaining repeated attacks against UTM Email Protection scanning.
What To Validate Now
- Inventory. Inventory every Sophos UTM appliance, exact version, Email Protection and scanning state, public mail interfaces, HA role, owners, logging coverage, backups, and maintenance windows.
- Establish applicability. Confirm that the UTM email proxy is used with scanning enabled; do not infer compromise from exposure alone, but treat sustained unsolicited traffic and process anomalies as reasons for incident review.
- Remediate. Follow Sophos's linked manual patch instructions immediately or migrate to a supported Sophos Firewall version. Restrict unnecessary exposure and preserve evidence before disruptive cleanup when indicators exist.
- Validate. Confirm patch installation or migration state, test inbound and outbound mail, scanning, quarantine, administration and HA, review proxy and system logs for repeated attack patterns, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Sophos UTM is end of life and the fix is manual. Test mail flow and HA carefully, but do not leave an exposed scanning proxy unpatched while planning a longer migration.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
