Sophos SG UTM path traversal lets unauthenticated attackers execute code as root (CVE-2026-118633)

What happened

CVE-2026-118633 is a path traversal vulnerability in Sophos SG UTM. It is reachable over the network by an unauthenticated attacker and requires no user interaction. The vulnerable condition exists when the email proxy is used with scanning enabled.

According to the CVE record, a successful exploit is not a single clean request: the attacker must win a race condition by sustaining repeated attacks for a few minutes. If that succeeds, the attacker can execute arbitrary code as root on the UTM, with high impact to the device's confidentiality, integrity and availability. The CVSS 4.0 score is 9.2, rated critical.

The CVE record and Sophos's advisory do not state that the flaw is being exploited in the wild.

Who is affected

Sophos SG UTM versions up to and including 9.724 are affected; the CVE record describes all versions as affected. This is typically an internet-facing unified threat management appliance, and the vulnerable path sits in the email proxy function. The issue is only exposed when email proxy scanning is enabled.

Sophos describes UTM as end-of-life, and no fixed version is listed in the CVE record or advisory.

What to do now

No fixed version is listed in the CVE record or Sophos's advisory. The CVE record says UTM is end-of-life and that any patch would be applied manually, but no patch identifier or release is provided.

1. Identify every Sophos SG UTM still in active use. Confirm whether the email proxy is enabled and whether scanning is turned on.
2. Reduce exposure immediately. If email proxy scanning is not required, disable it or remove the email proxy role. Restrict access to the UTM's management and proxy interfaces from untrusted networks.
3. Monitor these appliances for unusual volumes of repeated requests to the email proxy, which the CVE record links to the race condition.
4. Review removal or migration of end-of-life Sophos UTM appliances, since normal product support and patch cadence should not be assumed.

How to detect it

The Sophos advisory does not list indicators of compromise. Focus on exposure: inventory internet-facing Sophos SG UTM units and confirm which have email proxy scanning enabled. Because the CVE record says the race condition is won by sustaining repeated attacks for a few minutes, unusually high volumes of repeated requests to the email proxy may justify investigation.

Beyond the patch

This is the kind of issue that turns an ageing perimeter appliance into a root-level foothold. Spirity's Virtual CISO Services (vCISO) can help identify exposed and out-of-support security devices before an advisory does, and Managed Detection & Response (MDR) can detect the post-exploitation activity that follows a root shell on your security gateway.