What is the CVSS score and severity of CVE-2026-118633?

CVE-2026-118633 is rated CRITICAL with a CVSS score of 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and is classified under CWE-35 (Path Traversal).

CVE-2026-118633 CRITICAL · CVSS 9.2 · Sophos — Sophos UTM (SG UTM) · 2026-10-28

CVE-2026-118633: Email proxy with scanning enabled

Q: What versions are affected by CVE-2026-118633?

CVE-2026-118633 affects Sophos UTM all versions (SG UTM 9.724 and earlier) using the email proxy with scanning in Sophos UTM (SG UTM) (Email proxy with scanning enabled).

Q: How do I patch or remediate CVE-2026-118633?

To remediate CVE-2026-118633, upgrade to the patched release: Sophos UTM 9.724 plus manual patch KBA-000049692, or migrate to Sophos Firewall. Identify every Sophos UTM acting as an SMTP gateway with email scanning enabled. Update to 9.724 and install the manual patch from Sophos KBA-000049692. Plan migration to a supported Sophos Firewall; until patched, consider disabling email proxy scanning or blocking external access to it.

A path traversal in Sophos UTM lets an unauthenticated remote attacker run commands as root after winning a race condition by sustaining repeated attacks for a few minutes, when the email proxy is used with scanning enabled. UTM is end-of-life, so the fix must be installed manually.

Identifier

CVE-2026-118633

Vendor / Product

Sophos · Sophos UTM (SG UTM)

Severity / CVSS

CRITICAL · CVSS 9.2

Vector / CWE

CWE-35 (Path Traversal)

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected

Sophos UTM all versions (SG UTM 9.724 and earlier) using the email proxy with scanning

Patched Version

Sophos UTM 9.724 plus manual patch KBA-000049692, or migrate to Sophos Firewall

Priority

P0 — Manual Patch or Retire End-of-Life UTM Now

Executive Summary & Technical Impact

Tracked under CVE-2026-118633 (CWE-35 (Path Traversal)), this vulnerability affects Sophos UTM all versions (SG UTM 9.724 and earlier) using the email proxy with scanning and carries a severity score of 9.2 (CRITICAL). Engineering and security operations teams running Sophos UTM (SG UTM) should prioritize upgrading to Sophos UTM 9.724 plus manual patch KBA-000049692, or migrate to Sophos Firewall.

Remediation & Patch Guidance

Identify every Sophos UTM acting as an SMTP gateway with email scanning enabled.
Update to 9.724 and install the manual patch from Sophos KBA-000049692.
Plan migration to a supported Sophos Firewall; until patched, consider disabling email proxy scanning or blocking external access to it.

Frequently Asked Questions (CVE-2026-118633)

What versions are affected by CVE-2026-118633?

CVE-2026-118633 affects Sophos UTM all versions (SG UTM 9.724 and earlier) using the email proxy with scanning in Sophos UTM (SG UTM) (Email proxy with scanning enabled).

How do I patch or remediate CVE-2026-118633?

Upgrade affected deployments to Sophos UTM 9.724 plus manual patch KBA-000049692, or migrate to Sophos Firewall and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-118633?

CVE-2026-118633 is rated CRITICAL with a CVSS score of 9.2 (vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

Full TechPulse Investigation

Unauthenticated Root on the Edge: Juniper Session Smart Router (CVE-2026-103409) and Sophos UTM (CVE-2026-118633)

Two October 28 advisories hit network edge gear: a pair of CVSS 9.8 flaws in Juniper's SD-WAN platform and a manual-patch-only RCE in end-of-life Sophos UTM.

Read full engineering post-mortem (5 min read) →