A critical 0-day security vulnerability that affects Sophos Firewall solutions has been identified and is known to be actively exploited by threat actors.
The RCE vulnerability, tracked as CVE-2022-3236, exists due to incorrect login validation in the User Portal and WebAdmin interfaces of Sophos Firewall solutions. As a result, an unauthenticated, remote threat actor can execute arbitrary code on the target system via a specially crafted request.
The vulnerability affects all versions of Sophos Firewall 17.0.0 (inclusive) to 19.0.1. Sophos has released updates that fix the vulnerability. To avoid being affected by attacks that can be carried out using the vulnerability, it is recommended that users minimize the internet exposure of the User Portal and Webadmin interface and apply the published updates immediately.
Sophos UTM is a separate, end-of-life product and is not covered by this post. On 28 October 2026 Sophos published a critical advisory for it: read our Sophos UTM patch guide or the CVE-2026-118633 page.
What is CVE-2022-3236?
The National Vulnerability Database describes CVE-2022-3236 as a code injection vulnerability in the User Portal and Webadmin of Sophos Firewall. It lets a remote attacker run code on firewalls running version 19.0 MR1 and older. NVD lists a CVSS 3.1 base score of 9.8, the critical range, with network access, low complexity and no privileges or user action needed.
The NVD record was published on 23 September 2022. Sophos published its advisory (SA 20220923) under the same date, and the alert above says the flaw is known to be exploited by threat actors. It also notes that the flaw affects Sophos Firewall from 17.0.0 up to and including 19.0.1.
Did CISA list it as exploited?
Yes. CISA added CVE-2022-3236 to its Known Exploited Vulnerabilities catalog on 23 September 2022. US federal agencies had until 14 October 2022 to fix it. The catalog is a short list of flaws with confirmed attacks in the wild, so a listing here is a strong reason to patch first.
Why do firewall flaws like this matter?
A firewall sits at the edge of a network and often has high privileges. A flaw that lets an unauthenticated person run code through a web interface is dangerous for that reason. If the User Portal or Webadmin is open to the internet, anyone can send the crafted request without a password.
This is why the advice has two parts. Patch to the fixed release, and also cut the internet exposure of the management pages.
What should you do now?
- Check your Sophos Firewall version. If it is in the affected range, apply the update that Sophos published in its security advisory.
- Close the User Portal and Webadmin to the internet. Allow them only from trusted internal addresses or a VPN.
- Look through logs for odd requests to those two pages around and after September 2022, in case the firewall was already hit.
- If you find signs of a compromise, treat the firewall as untrusted and rebuild it from a clean state before you restore the settings.
Brandefense tracks exposed services as part of its work on cyber threat intelligence. More alerts like this one are in our security news archive.