Sophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product

Sophos published an advisory on Oct 28 for CVE-2026-118633, a path traversal vulnerability in Sophos UTM that lets an unauthenticated remote attacker execute arbitrary commands as root after winning a race condition by sustaining repeated attacks for a few minutes. It is reachable when the UTM email proxy is used with scanning enabled. All Sophos UTM versions are affected (the CVE record lists SG UTM 9.724 and earlier). Sophos UTM is end-of-life, so the fix is not delivered automatically: Sophos says urgent customer action is required, the patch must be installed manually, and customers still using Email Protection on UTM should apply it as soon as possible or move to a supported version of Sophos Firewall. The issue was reported through the Sophos bug bounty program by Sam Pizzey.

Why this severity: CVSS 9.2 Critical (v4.0) and 8.1 High (v3.1) from Sophos; unauthenticated root code execution, but it needs a race condition won over a few minutes and the email proxy with scanning enabled; no exploitation reported

Started

Oct 28, 2026

CVE

CVE-2026-118633

• #Sophos
• #Sophos UTM
• #Firewall
• RCE
• #Path Traversal
• #End of life

Notes & caveats

Sophos credits Sam Pizzey, who reported the bug through the Sophos bug bounty program. The CVE record classifies it as CWE-35 (path traversal with doubled triple-dot-slash sequences).