# Sophos UTM: manual patch for root command execution Canonical: https://www.oktsec.com/radar/sophos-utm-cve-2026-118633 Publisher: Oktsec Language: en Published: 2026-10-29T17:53:35Z Updated: 2026-10-29T17:53:35Z Record reviewed: 2026-10-29T17:53:35Z Latest evidence check: 2026-10-29T17:53:35Z Disclosed: 2026-10-28 An unauthenticated attacker can execute commands as root when the UTM email proxy uses scanning. Sophos requires a manual patch; UTM remains outside support. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Sophos calls for urgent manual patching of an unsupported product. The email proxy configuration permits root command execution without authentication; the reviewed advisory does not establish attacks in the wild. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Sophos - Products: Sophos UTM - CVEs: CVE-2026-118633 ## Technical overview Sophos describes path traversal followed by a race condition. Repeated attempts over several minutes can lead to command execution as root when email proxy scanning is enabled. Authentication is not required. The vendor lists all UTM versions, calls for manual patch installation and recommends migration to a supported firewall. This is an exceptional correction for a product that remains at end of life. The October 28 advisory confirms the vulnerability and remediation. It does not establish exploitation in the wild. The linked installation KB returned a loading/CSS error during this review, so package identity, commands and installation checks remain unverified. Follow the official KB rather than an inferred procedure. ## Recommended response Follow Sophos KBA-000049692 to obtain and manually install the exceptional patch, and plan migration to a supported firewall. The installation procedure still needs verification. Relevant to: Organizations still using Sophos UTM Email Protection with proxy scanning enabled. ## CVE attribution - CVE-2026-118633: Sophos — Sophos UTM. [Source](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce) ## Affected systems and fixes ### Sophos UTM email proxy with scanning enabled Affected: All versions according to Sophos; the stated execution path requires email proxy scanning. Fixed release / action: Exceptional manual patch referenced by Sophos KBA-000049692; package identifier and installation steps not verified. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.28 Checked: 2026-10-28T23:52:19.770Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-118633 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Identify UTM email proxy deployments** — Inventory UTM installations and verify whether Email Protection uses the email proxy with scanning enabled. The advisory lists all versions; do not infer that every UTM feature exposes the same attack path. 2. **Obtain the official manual patch instructions** — Open KBA-000049692 from the Sophos advisory. Verify package applicability, prerequisites and success checks before executing the procedure. The KB did not render during this review; no installation commands or package hashes are supplied here. 3. **Record evidence that the patch was installed** — Use the vendor procedure to verify the result and retain the maintenance record. Do not assume an automatic update applied this manual correction. The advisory lists no workaround. 4. **Plan migration to a supported platform** — Sophos recommends a supported Sophos Firewall release. The exceptional patch does not restore UTM support. Oktsec recommends recording an owner and replacement plan for remaining deployments. ## Relevance to AI environments The advisory does not identify an AI-specific attack. Oktsec recommends reviewing mail and infrastructure dependencies when planning replacement of an unsupported gateway. ## Sources - [Sophos UTM: manual patch for root command execution](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce) — Sophos; Vendor notice; checked 2026-10-29T17:42:53Z ## Editorial record - 2026-10-29T17:53:35Z: Added the vendor advisory, affected configuration and response steps. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/sophos-utm-cve-2026-118633) · [Build a response plan](https://www.oktsec.com/radar/sophos-utm-cve-2026-118633#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=sophos-utm-cve-2026-118633&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=sophos-utm-cve-2026-118633&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.