CVE-2022-3236: Sophos Firewall Code Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-09-23. EPSS: 98.9% chance of exploitation in the next 30 days.

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

Affected products

• Sophos Firewall: up to and including 19.0.1

Published 2022-09-23. Last modified 2026-06-17.