Sophos UTM Email Proxy Remote Code Execution (CVE-2026-118633)

Sophos describes a path traversal flaw in Sophos UTM. A remote attacker with no account can run arbitrary commands with root privileges, but only after winning a race condition. The attacker does that by sustaining repeated attacks for a few minutes, when the email proxy is used with scanning enabled. A race condition is a timing bug: the outcome depends on which of two actions finishes first, so the attacker keeps trying until one attempt lands.

Sophos rates the advisory Critical and lists no workaround. The CVE record carries two scores, both set by Sophos as the CVE assigner: CVSS 4.0 base 9.2 Critical, and CVSS 3.1 base 8.1 High with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Sophos lists the weakness as CWE-35 in the CVE record, and NVD has not scored the record itself.

Sophos credits the external researcher Sam Pizzey, who reported the flaw through the Sophos bug bounty program. The advisory does not say whether the flaw is exploited. CISA's Known Exploited Vulnerabilities catalogue, version 2026.10.28, does not list the CVE (checked 28 October 2026).

Sophos lists Sophos UTM, all versions, as affected. The NVD record, filled in by Sophos, names the product SG UTM and the affected versions as everything up to and including 9.724. That is also the release Sophos tells owners to install before the patch, so the patch is a separate step on top of it.

Sophos' patch article applies to a UTM set up as an SMTP gateway. The advisory says customers still using Email Protection features should patch as soon as possible, and that the flaw is reached through the email proxy with scanning enabled.

Sophos says UTM is past its 30 June 2026 end-of-life date, so the patch must be installed by hand. Sophos Firewall is a different product, and the advisory does not list it as affected. The older CVE-2022-3236 flaw in Sophos Firewall is about that product and unrelated.