An unauthenticated attacker can execute commands as root when the UTM email proxy uses scanning. Sophos requires a manual patch; UTM remains outside support.
Who should check: Organizations still using Sophos UTM Email Protection with proxy scanning enabled.
Follow Sophos KBA-000049692 to obtain and manually install the exceptional patch, and plan migration to a supported firewall. The installation procedure still needs verification.
Sophos describes path traversal followed by a race condition. Repeated attempts over several minutes can lead to command execution as root when email proxy scanning is enabled. Authentication is not required.
The vendor lists all UTM versions, calls for manual patch installation and recommends migration to a supported firewall. This is an exceptional correction for a product that remains at end of life.
The October 28 advisory confirms the vulnerability and remediation. It does not establish exploitation in the wild. The linked installation KB returned a loading/CSS error during this review, so package identity, commands and installation checks remain unverified. Follow the official KB rather than an inferred procedure.
| Product | Affected | Fixed release / action |
|---|---|---|
| Sophos UTM email proxy with scanning enabled | All versions according to Sophos; the stated execution path requires email proxy scanning. | Exceptional manual patch referenced by Sophos KBA-000049692; package identifier and installation steps not verified. |
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
Sophos calls for urgent manual patching of an unsupported product. The email proxy configuration permits root command execution without authentication; the reviewed advisory does not establish attacks in the wild.
The advisory does not identify an AI-specific attack. Oktsec recommends reviewing mail and infrastructure dependencies when planning replacement of an unsupported gateway.
Added the vendor advisory, affected configuration and response steps.
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
Check affected systems and versions, then record your decision below. If you are unsure, choose “Needs verification”.
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Inventory UTM installations and verify whether Email Protection uses the email proxy with scanning enabled. The advisory lists all versions; do not infer that every UTM feature exposes the same attack path.
Open KBA-000049692 from the Sophos advisory. Verify package applicability, prerequisites and success checks before executing the procedure. The KB did not render during this review; no installation commands or package hashes are supplied here.
Use the vendor procedure to verify the result and retain the maintenance record. Do not assume an automatic update applied this manual correction. The advisory lists no workaround.
Sophos recommends a supported Sophos Firewall release. The exceptional patch does not restore UTM support. Oktsec recommends recording an owner and replacement plan for remaining deployments.
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|---|---|
| Sophos UTM email proxy with scanning enabled | All versions according to Sophos; the stated execution path requires email proxy scanning. | Exceptional manual patch referenced by Sophos KBA-000049692; package identifier and installation steps not verified. |
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Sophos calls for urgent manual patching of an unsupported product. The email proxy configuration permits root command execution without authentication; the reviewed advisory does not establish attacks in the wild.
Prioritization criteriaCatalog 2026.10.28 · Checked Oct 28, 2026 UTC
No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.
| Product / CVE | Attack evidence | Source guidance |
|---|---|---|
| Sophos UTMCVE-2026-118633 | Attacks not established The reviewed evidence does not establish whether this vulnerability was used in attacks. | Sophos sourceReview affected systems |
Forecast unavailable. This is not a zero score.
FIRST EPSS · Checked 2026-10-27 15:30 UTC
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
| Product / service | Sophos UTMSophos |
|---|---|
| CVE | CVE-2026-118633 |
| Exploitation evidence | Attacks not established |
| Access required | Application or configuration dependent |
| Fix / response | Fix availableAffected versions and fixes |
The advisory does not identify an AI-specific attack. Oktsec recommends reviewing mail and infrastructure dependencies when planning replacement of an unsupported gateway.