Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

Sophos UTM

Security incidents tagged Sophos UTM. Newest first.

1 Sophos UTM incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
1
Live
1
Patched
1
Days without an incident
1
Longest quiet run: 1 day (Oct 29–Oct 29)
All tags →
  • Patched

    Sophos UTM: pre-auth root RCE through the email proxy (CVE-2026-118633), manual patch for an end-of-life product

    Sophos published an advisory on Oct 28 for CVE-2026-118633, a path traversal vulnerability in Sophos UTM that lets an unauthenticated remote attacker execute arbitrary commands as root after winning a race condition by sustaining repeated attacks for a few minutes. It is reachable when the UTM email proxy is used with scanning enabled. All Sophos UTM versions are affected (the CVE record lists SG UTM 9.724 and earlier). Sophos UTM is end-of-life, so the fix is not delivered automatically: Sophos says urgent customer action is required, the patch must be installed manually, and customers still using Email Protection on UTM should apply it as soon as possible or move to a supported version of Sophos Firewall. The issue was reported through the Sophos bug bounty program by Sam Pizzey.

    Sophos UTM (SG UTM), all versions, with the email proxy and scanning enabledSince Oct 28, 2026

Sponsored

Buy sponsor slot