ZeusQA
Start free

Known exploited vulnerabilities

Sophos vulnerabilities attackers have used

Every Sophos vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 7 Sophos vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 2 used in ransomware campaigns. The most recent is CVE-2020-29574, added Feb 6, 2025. Firewall has the most entries (2).

In KEV, all time
7
Added, last 12 months
0
Used in ransomware
2
New CVEs this week
0

By product

Firewall (2), CyberoamOS (1), SFOS (1), SG UTM (1), Web Appliance (1), XG Firewall (1).

Every Sophos entry in CISA KEV

  1. CVE-2020-29574

    RansomwareAdded · due

    CyberoamOS (CROS) SQL Injection Vulnerability

    CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.

  2. CVE-2020-15069

    Added · due

    Sophos XG Firewall Buffer Overflow Vulnerability

    Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.

  3. CVE-2023-1671

    Added · due

    Sophos Web Appliance Command Injection Vulnerability

    Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.

  4. CVE-2022-3236

    Added · due

    Sophos Firewall Code Injection Vulnerability

    A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.

  5. CVE-2022-1040

    Added · due

    Sophos Firewall Authentication Bypass Vulnerability

    An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.

  6. CVE-2020-25223

    Added · due

    Sophos SG UTM Remote Code Execution Vulnerability

    A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.

  7. CVE-2020-12271

    RansomwareAdded · due

    Sophos SFOS SQL Injection Vulnerability

    Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote…

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works