Sophos UTM Path Traversal Allows Root Code Execution

What happened

Sophos UTM has a critical security flaw that can let a remote attacker run code with the system's highest privileges. Think of it as someone slipping past a building's mailroom controls and gaining access to the master keys. The issue involves the email proxy when scanning is enabled, and the attacker does not need to sign in.

The vendor advisory identifies Sophos UTM 9.724 and earlier as affected by CVE-2026-118633. The vulnerability combines path traversal with a race condition: an attacker must repeatedly attempt the attack for a few minutes to reach the timing needed for code execution. Sophos UTM is end-of-life, and the patch must be installed manually.

NVD published the vulnerability on 2026-10-28 and assigns it a critical severity rating. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-30. Administrators should use the Sophos advisory for remediation instructions and NVD for the vulnerability's technical classification.

Technical details

The underlying weakness is path traversal, classified as CWE-35. Path traversal means a system allows a file path to reach outside the location it should be allowed to access. For developers, the key security boundary is whether a path stays within its intended scope. Here, the described consequence extends to arbitrary code execution: the attacker can cause the system to run code of the attacker's choosing.

Successful execution occurs as root, the account with the highest level of control over the system. This makes the consequence more serious than an error confined to an ordinary user account. The available description does not identify the particular files, requests, or internal processing steps involved, so it does not support a more detailed reconstruction of the vulnerable code.

The attack has specific preconditions. The email proxy must be in use with scanning enabled, and the remote attacker must win a race condition. A race condition is a timing problem in which the outcome depends on how operations overlap. The description says repeated attacks sustained for a few minutes can produce the required timing; it does not describe code execution as the immediate result of an isolated attempt.

NVD rates CVE-2026-118633 at 9.2 under CVSS 4.0, with a severity of CRITICAL. CVSS is a standardized way to describe vulnerability severity. That rating helps administrators prioritize remediation, but it does not establish whether a particular installation has been attacked or whether exploitation has occurred.

Weakness types: Remote/arbitrary code execution, Path traversal

Who is affected

Everyday users

Everyday users are most likely to encounter this issue through an organization that uses Sophos UTM to handle email. The relevant condition is email proxy scanning on that system. Users do not need to have a Sophos UTM account for their organization's deployment to warrant an administrator's review.

The described impact is control of the Sophos UTM system through code running as root. It does not establish that an individual user's device or mailbox has been compromised. The practical response for users is to have the team responsible for Sophos UTM confirm the deployment's status and complete the vendor's remediation process.

Developers

Developers supporting systems that depend on Sophos UTM should identify who owns the appliance and its email proxy configuration. Application maintenance alone does not address a vulnerability in the Sophos UTM system. Coordination with the infrastructure team is necessary to establish whether the affected version and feature conditions apply.

The flaw also illustrates why file access boundaries and timing behavior need to be considered together during security reviews. A path traversal weakness can have consequences beyond unintended file access, and a race condition can make repeated attempts relevant. For this advisory, however, the concrete remediation belongs to the Sophos UTM deployment and the vendor's update process.

Server and IT admins

Administrators should review Sophos UTM installations running 9.724 and earlier and determine whether the email proxy is used with scanning enabled. That feature combination is central to the described attack. Because authentication is not required, reviewing user accounts alone does not establish whether the attack preconditions are present.

Remediation requires particular attention because Sophos UTM is end-of-life and the patch must be installed manually. The stated action is to migrate to a fixed release, but a specific fixed version is not identified here. Follow the update steps in the vendor's advisory to determine the applicable release and installation procedure.

What to do now

1. Identify the Sophos UTM installations you manage and record their installed versions. Treat 9.724 and earlier as affected under the vendor advisory.
2. Check whether each installation uses the email proxy with scanning enabled. Record this alongside the version so the team can assess the described attack conditions.
3. Review the vendor advisory to identify the applicable fixed release and its manual patch requirements. Do not assume an automatic update has completed the remediation.
4. Follow the update steps in the vendor's advisory and migrate affected installations to a fixed release.
5. After installation, confirm the installed release against the vendor advisory and check that the email proxy and scanning functions needed by your organization operate as intended.
6. Include Sophos UTM's end-of-life status in your longer-term maintenance planning so responsibility for its ongoing use and migration is explicit.

If you can't update yet

• Check the vendor advisory for guidance on restricting access and reducing internet exposure while remediation is pending. These measures should be treated as temporary risk reduction.
• Check the vendor advisory for any recommendation to disable the affected email proxy scanning feature. Follow that guidance if offered, and assess the effect on email handling before making the change.

How to confirm the fix

• Compare the installed release with the fixed-release guidance in the vendor advisory. A record of the previous version or a planned update does not confirm completion.
• Confirm that the manual patch installation completed according to the vendor's update steps. Keep the installation result with the deployment's maintenance record.
• Check that expected email proxy and scanning behavior still works after remediation. Functional checks help confirm service operation; confirmation of the security fix still depends on the installed release and the vendor's guidance.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 1 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Sophos advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce
• NVD: CVE-2026-118633
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 30, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.