CVE-2022-1807: Sophos Firewall

High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days.

Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1.

Affected products

• Sophos Firewall: before 18.5 (fixed in 18.5); version 18.5 only; version 19.0 only

Published 2022-09-07. Last modified 2026-06-17.