CVE-2021-25273: Sophos Unified Threat Management

Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.

Affected products

• Sophos Unified Threat Management: before 9.706 (fixed in 9.706)

Published 2021-07-29. Last modified 2026-06-17.