External risk intelligence

Sophos UTM Path Traversal Code Execution Via Email Proxy

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-118633

The vulnerability affects a network email proxy component of an internet-facing security appliance (Sophos UTM). Email proxies are designed to reside at the network edge to inspect incoming traffic from the internet, making this interface inherently exposed to public network communication in its normal and intended deployment.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Sophos UTM, a security appliance that is no longer supported. This flaw could allow an unauthenticated attacker to gain root-level code execution by repeatedly attacking the system's email proxy when scanning is enabled. Remediation requires manual patching of this end-of-life product.

Attackers could gain full control of the system.
This affects an internet-facing security device.
Confirm relevance and ensure appropriate action.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by repeatedly targeting the Sophos UTM's email proxy. This component, when configured for scanning, is exposed to the internet and can be attacked by unauthenticated users. By sustaining repeated attacks over several minutes, the attacker can manipulate a race condition, leading to arbitrary code execution with root privileges.

Internet-accessible email proxy exposure.
Race condition triggered by repeated attacks.
Arbitrary code execution as root.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker could execute arbitrary code as root on Sophos UTM systems. This could occur after repeated attacks over several minutes when the email proxy is used with scanning enabled. As Sophos UTM is end-of-life, manual patching is required.

Arbitrary code execution as root.
Race condition exploited over network.
Compromised system integrity and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Sophos UTM, an end-of-life product requiring manual patching, and likely impacts infrastructure or platform teams responsible for network security appliances. The first critical step is to inventory all Sophos UTM instances, confirm their internet reachability and business criticality, identify the specific asset owners, and then prioritize remediation efforts.

Identify Sophos UTM owners.
Verify internet reachability and criticality.
Plan manual patch deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Sophos UTM and what is it used for?

Sophos UTM is a security appliance historically deployed as an all-in-one gateway solution. It provides network protection, web filtering, and, significantly for this vulnerability, an email proxy service. Organizations relied on it to inspect, secure, and manage traffic at the edge of their networks before it reached internal systems.

How does path traversal lead to code execution in CVE-2026-118633?

The vulnerability is classified as CWE-35 (Path Traversal). In this specific case, the weakness allows an attacker to manipulate file paths within the system. By repeatedly targeting the email proxy, the attacker triggers a race condition that escalates this access, eventually allowing them to execute arbitrary commands with root-level privileges.

Do I need email scanning enabled for CVE-2026-118633 to trigger?

Yes. This vulnerability requires the email proxy component to have scanning features active. If your Sophos UTM deployment does not utilize the email proxy or has scanning features disabled, this specific attack path is not present. The exploit also requires a sustained, repeated attack effort lasting several minutes to successfully win the race condition.

Is my network at risk from this CVE-2026-118633 vulnerability?

Halo Surface Signal indicates this is a high-risk scenario because Sophos UTM appliances typically sit at the network edge to inspect incoming traffic. If your instance is internet-facing and actively processing email, it is directly exposed to external, unauthenticated attackers who can attempt to trigger this flaw remotely.

What should I do first if I am running Sophos UTM?

Since this product is end-of-life, you must immediately inventory your environment to locate all active instances. Verify which units have the email proxy and scanning features enabled. Because automated updates are no longer provided, you need to coordinate with your infrastructure team to manually apply the required patches or prioritize the migration of these appliances to a supported solution.

References

www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.