# Sophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product · pwn.watch > Sophos published an advisory on Oct 28 for CVE-2026-118633, a path traversal vulnerability in Sophos UTM that lets an unauthenticated remote attacker execute arbitrary commands as root after winning a race condition by sustaining repeated attacks for a few minutes. It is reachable when the UTM email proxy is used with scanning enabled. All Sophos UTM versions are affected (the CVE record lists SG UTM 9.724 and earlier). Sophos UTM is end-of-life, so the fix is not delivered automatically: Sophos says urgent customer action is required, the patch must be installed manually, and customers still using Email Protection on UTM should apply it as soon as possible or move to a supported version of Sophos Firewall. The issue was reported through the Sophos bug bounty program by Sam Pizzey. Page: https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633 · generated 2026-10-28T22:05:28.248Z ## Status - Severity: critical · status: live · patch: patched - Product: Sophos UTM (SG UTM), all versions, with the email proxy and scanning enabled - Started: 2026-10-28 - CVEs: CVE-2026-118633 - Affected: Sophos UTM, all versions (CVE record: SG UTM 9.724 and earlier) - Fixed in: Manual patch from Sophos KBA-000049692; Migration to a supported Sophos Firewall version ## Follow this incident - RSS (one item per update): https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633/feed.xml - JSON Feed: https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633.json - This file: https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633/llms.txt ## Updates (newest first) - 2026-10-28: Sophos publishes advisory sophos-sa-20261028-utm-rce for CVE-2026-118633, saying urgent action is required and the patch for the end-of-life UTM must be installed manually. (https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce) ## Fix brief # Security brief: Sophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product Source: https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633 · status: live · severity: critical · updated Oct 28, 2026, 19:44 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Sophos published an advisory on Oct 28 for CVE-2026-118633, a path traversal vulnerability in Sophos UTM that lets an unauthenticated remote attacker execute arbitrary commands as root after winning a race condition by sustaining repeated attacks for a few minutes. It is reachable when the UTM email proxy is used with scanning enabled. All Sophos UTM versions are affected (the CVE record lists SG UTM 9.724 and earlier). Sophos UTM is end-of-life, so the fix is not delivered automatically: Sophos says urgent customer action is required, the patch must be installed manually, and customers still using Email Protection on UTM should apply it as soon as possible or move to a supported version of Sophos Firewall. The issue was reported through the Sophos bug bounty program by Sam Pizzey. Severity detail: CVSS 9.2 Critical (v4.0) and 8.1 High (v3.1) from Sophos; unauthenticated root code execution, but it needs a race condition won over a few minutes and the email proxy with scanning enabled; no exploitation reported - Product: Sophos UTM (SG UTM), all versions, with the email proxy and scanning enabled - CVE / advisory ids: CVE-2026-118633 ## Affected versions - Sophos UTM, all versions (CVE record: SG UTM 9.724 and earlier) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Manual patch from Sophos KBA-000049692 - Migration to a supported Sophos Firewall version After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes If you still run Sophos UTM, check whether Email Protection (the email proxy with scanning) is enabled. If it is, install the manual patch following Sophos KBA-000049692 right away, since UTM is end-of-life and won't get it automatically. If you can't patch yet, turn off the email proxy or keep it from receiving untrusted mail until you do. Plan the move to a supported Sophos Firewall version. ## Latest updates - Oct 28, 2026: Sophos publishes advisory sophos-sa-20261028-utm-rce for CVE-2026-118633, saying urgent action is required and the patch for the end-of-life UTM must be installed manually. ## Advisories - [Resolved Pre-Auth RCE Vulnerability in Sophos UTM (CVE-2026-118633)](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce) (Sophos) - [Sophos UTM patch installation instructions (KBA-000049692)](https://support.sophos.com/support/s/article/KBA-000049692?language=en_US) (Sophos) - [CVE-2026-118633](https://www.cve.org/CVERecord?id=CVE-2026-118633) (CVE.org) ## Caveats Sophos credits Sam Pizzey, who reported the bug through the Sophos bug bounty program. The CVE record classifies it as CWE-35 (path traversal with doubled triple-dot-slash sequences). --- Machine-readable: https://pwn.watch/i/sophos-utm-email-proxy-preauth-rce-cve-2026-118633.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.