CVE-2018-16116: Sophos SFOS

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter.

Affected products

• Sophos SFOS: version 17.0.8 only

Published 2019-06-20. Last modified 2026-06-17.