CVE-2021-25267: Sophos Firewall Firmware

High severity, CVSS 8.4. EPSS: 1.1% chance of exploitation in the next 30 days.

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA.

Affected products

• Sophos Firewall Firmware: before 19.0 (fixed in 19.0)

Published 2022-05-05. Last modified 2026-06-17.