Sophos patches end-of-life UTM against pre-auth root command flaw

Sophos patches end-of-life UTM against pre-auth root command flaw

28 October 2026: Sophos has released a patch for CVE-2026-118633, a critical path traversal flaw in every version of Sophos UTM that lets an attacker who is not logged in run commands as root. The product has reached end of life, so the patch is not delivered automatically and has to be installed by hand. Sophos rates the issue critical and calls for urgent customer action; it does not say whether the flaw has been exploited.

When a UTM is exposed

The flaw sits in the email path. According to the advisory, an attacker has to win a race condition by keeping up repeated attacks for a few minutes, and the attack works when the email proxy is in use with scanning switched on. UTMs still used for Email Protection, filtering inbound mail for an organisation, are therefore the ones at risk, and Sophos singles them out: customers still using Email Protection features "should apply the patch as soon as possible".

A UTM used only as a firewall, with the email proxy off, is not in the scenario Sophos describes, though the advisory lists all versions as affected. The flaw was reported through Sophos's bug bounty programme by the researcher Sam Pizzey.

Patching a product that is no longer supported

The advisory gives two remedies:

• upgrade to a supported version of Sophos Firewall, the product Sophos sells in UTM's place;
• follow the patch installation instructions in Sophos support article KBA-000049692, which carries the steps for a manual installation.

For most owners the practical order is the patch first, because a migration takes planning, and the move to Sophos Firewall after. Sophos does not publish a fixed build number in the advisory, so the knowledge base article is the reference for confirming the patch is in place. The advisory lists no workaround.

Why this keeps coming back

Retired security appliances are a recurring source of exposure because they sit at the edge and stop receiving routine updates. A vendor patching an end-of-life product at all, as Sophos has here, usually reflects how severe the flaw is and how many devices remain in service. Owners who kept a UTM running for mail filtering after support ended now have a forced choice: patch by hand today and plan the migration, or take the email proxy out of the path.

Italy's and Germany's national CERTs repeated the warning the next day. We list Sophos as a company.

Sources

• Sophos Security Advisory sophos-sa-20261028-utm-rce, 28 October 2026
• CVE record CVE-2026-118633, 28 October 2026