Sophos UTM path traversal allows unauthenticated root code execution (CVE-2026-118633)

What happened

The vulnerability is a path traversal in Sophos SG UTM that a remote attacker can reach over the network without credentials. To trigger it, the attacker must be able to reach an email proxy that has scanning enabled, and must sustain repeated attempts for a few minutes to win a race condition. When successful, the attacker can execute arbitrary code as root on the UTM device.

The CVSS 4.0 score is 9.2 (critical), with a network attack vector, low complexity, no user interaction and high impact to confidentiality, integrity and availability of the affected device. The CVE record does not report exploitation in the wild, and there is no CISA KEV entry for it.

Who is affected

Sophos SG UTM up to and including version 9.724. The vulnerable condition is the email proxy with scanning enabled, so installations that do not use email proxy scanning are not exposed through this path. Sophos UTM is end-of-life, and the advisory does not list a fixed version; the CVE record states that the patch must be installed manually. These systems often sit at the network perimeter as unified threat management appliances, where remote attackers can reach them.

What to do now

1. Confirm whether you run Sophos SG UTM up to and including 9.724 and whether the email proxy has scanning enabled. If scanning is not required for your mail flow, consider disabling it temporarily as containment.
2. Restrict network access to the email proxy so that only trusted mail servers can reach it; do not expose the UTM email proxy to the wider internet if you can avoid it.
3. Do not wait for the normal update channel. The advisory does not list a fixed version and Sophos UTM is end-of-life; the CVE record says the patch must be installed manually. Check Sophos's advisory and contact Sophos support for the specific manual patch.
4. If the device cannot be patched immediately, increase monitoring of the UTM for unexpected root-level processes, new outbound connections or changes to mail scanning behaviour.

Beyond the patch

Beyond the immediate patch, this is a reminder that end-of-life network appliances linger at the perimeter long after regular update coverage stops, and a remotely reachable service without credentials is a problem before exploitation is ever observed. Our Virtual CISO Services can help you identify the internet-facing services and open ports on your estate that an unauthenticated attacker would find first. If code execution does occur, the resulting activity is what Managed Detection & Response is built to surface through EDR and SIEM monitoring.