{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Sophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product · updates",
  "home_page_url": "https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633",
  "feed_url": "https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633/feed.json",
  "description": "Sophos published an advisory on Oct 28 for CVE-2026-118633, a path traversal vulnerability in Sophos UTM that lets an unauthenticated remote attacker execute arbitrary commands as root after winning a race condition by sustaining repeated attacks for a few minutes. It is reachable when the UTM email proxy is used with scanning enabled. All Sophos UTM versions are affected (the CVE record lists SG UTM 9.724 and earlier). Sophos UTM is end-of-life, so the fix is not delivered automatically: Sophos says urgent customer action is required, the patch must be installed manually, and customers still using Email Protection on UTM should apply it as soon as possible or move to a supported version of Sophos Firewall. The issue was reported through the Sophos bug bounty program by Sam Pizzey.",
  "language": "en",
  "_pwn": {
    "slug": "sophos-utm-email-proxy-preauth-rce-cve-2026-118633",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633/feed.xml",
    "llms": "https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633/llms.txt",
    "json": "https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633#2026-10-28-92c9f3a6",
      "url": "https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633#2026-10-28-92c9f3a6",
      "title": "Sophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product: Sophos publishes advisory sophos-sa-20261028-utm-rce for CVE-2026-118633, saying urgent action is required and the patch for the end-of-life UTM must be installed manually.",
      "content_text": "Sophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product: Sophos publishes advisory sophos-sa-20261028-utm-rce for CVE-2026-118633, saying urgent action is required and the patch for the end-of-life UTM must be installed manually.\n\nSource: https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce",
      "date_published": "2026-10-28T00:00:00.000Z",
      "external_url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce",
      "tags": [
        "critical"
      ]
    }
  ]
}