CVE-2018-16117: Sophos SFOS

High severity, CVSS 8.8. EPSS: 44.3% chance of exploitation in the next 30 days.

A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter.

Affected products

• Sophos SFOS: up to and including 17.0; version 17.1 only

Published 2019-06-20. Last modified 2026-06-17.