CVE-2021-25268: Sophos Firewall Firmware

High severity, CVSS 8.4. EPSS: 0.9% chance of exploitation in the next 30 days.

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA.

Affected products

• Sophos Firewall Firmware: before 19.0 (fixed in 19.0)

Published 2022-05-05. Last modified 2026-06-17.