Sophos UTM passed its end-of-life date on 30 June 2026, yet on 28 October Sophos published a Critical fix for it and said the patch must be installed by hand. The flaw, CVE-2026-118633, lets a remote attacker with no account run commands as root through the email proxy. If your UTM still handles mail, the steps below are today’s job.
The flaw has its own CVE-2026-118633 page. This post follows the Sophos patch article in the order you work through it, and explains why that order makes sense.
Last updated: 28 October 2026. We update this page if Sophos or CISA change their notes.
Does Your UTM Take Mail From the Internet?
Sophos lists Sophos UTM, all versions, as affected. The risk sits in the email proxy when scanning is enabled. The Sophos patch article says the flaw could be used by anyone who can connect to the appliance to deliver email. It applies to a UTM set up as an SMTP gateway.
Sophos puts the urgency on customers who still use Email Protection features on UTM. The NVD record names the product SG UTM and lists versions up to and including 9.724.
The bug is a path traversal: a request makes software reach files outside the folder it should stay in. Sophos adds that the attacker must also win a race condition, a timing contest, by repeating attacks for a few minutes. A win gives commands with root privileges, the highest level on the appliance.
Sophos set both scores in the CVE record: 9.2 Critical under CVSS 4.0 and 8.1 High under CVSS 3.1. The advisory credits the researcher Sam Pizzey, who reported it through the Sophos bug bounty program.
The Seven Steps From the Sophos Article
Sophos published the steps on 28 October as knowledge base article KBA-000049692. The list below follows it in order. Copy the checksum values from the Sophos article itself, because this post does not repeat them.
- Update UTM to 9.724Sophos says to install the latest version, 9.724, first if the appliance is not already on it.
- Open the UTM shellSign in as loginuser if you connect remotely. If you are at the console with a keyboard attached, sign in as root.
- Download the RPMRun wget https://download.astaro.com/UTM/v9/patch/ep-cssd-64-9.70-29.g7f03cc7.x86_64.rpm on the UTM. You can also download it elsewhere and copy it over with scp.
- Check the SHA256 valueRun sha256sum ep-cssd-64-9.70-29.g7f03cc7.x86_64.rpm and compare the result with the value printed in the Sophos article. Stop if they differ.
- Install the packageRun sudo rpm -Uvh --force ep-cssd-64-9.70-29.g7f03cc7.x86_64.rpm. The article shows a Preparing line and a 1:ep-cssd-64 line, both ending at 100%.
- Check the installed fileRun sha256sum /usr/bin/cssd and compare the result with the value in the article. Sophos says this confirms the fix is applied.
- Restart the componentRun sudo /var/mdw/scripts/cssd restart.
Why the Order Matters
Sophos puts the update first, and the patch comes as one RPM package. Our reading is that the package is meant for the latest release, but the article does not say so in as many words. Apply the update before you touch the RPM.
The hash check comes before the install because you are about to run a downloaded package with root rights. A matching SHA256 value tells you the file is the one Sophos listed. Read the expected value from the Sophos page in a separate browser tab, not from a note or a chat message.
The second hash check, on /usr/bin/cssd, is Sophos’ own proof that the fix is in place. The restart comes last. A service normally keeps running the code it loaded at start, so the old version can stay in memory until the component restarts. Treat the job as unfinished until that command has run.
Sophos’ advisory and article give no indicators of compromise or detection steps. Patching, or a move to a supported Sophos Firewall, is the only action they describe, which makes the patch the first job in any patch management queue this week.
When Patching Has to Wait
Sophos lists the workaround as No. It names two remediations: install the manual patch, or upgrade to a supported version of Sophos Firewall. It gives no interim setting for a UTM that cannot be patched today.
Sophos says most customers have already moved to Sophos Firewall and urges the rest to finish the move as soon as possible. That is a different product from UTM. Our older post on a 2022 flaw in Sophos Firewall covers an unrelated bug, so its advice does not carry over.
Two practical points come from the same Sophos community post. The MyUTM licensing site is permanently offline, so ask Sophos Customer Care for a copy of your license file before a migration. Sophos also says it pushed the eMudhra certificate updates to UTM through Up2date last week, so keep Up2date switched on. Our eMudhra CA key compromise page explains that incident.
What Sophos Says About Attacks
The advisory does not say whether the flaw is exploited. CISA’s Known Exploited Vulnerabilities catalogue, version 2026.10.28, does not list CVE-2026-118633. The NVD record was published on 28 October at 19:17 UTC and shows the status Received, so NVD has not analysed it yet.
- Sophos fixYesA manual RPM patch in KBA-000049692 and the advisory sophos-sa-20261028-utm-rce28 Oct
- Workaround offeredNot seenSophos lists Workaround: No; the options are the patch or a supported Sophos Firewall28 Oct
- Exploitation stated by SophosUnknownThe advisory does not say whether the flaw is exploited28 Oct
- CISA KEVNot seenNot listed in the catalogue updated on 28 October 202628 Oct
Sophos says the attack needs sustained attempts over a few minutes. Check the Sophos article, NVD and the CISA catalogue again over the coming days for any change.