CVE-2022-4901: Sophos Connect

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim.

Affected products

• Sophos Connect: before 2.2.90 (fixed in 2.2.90)

Published 2023-03-01. Last modified 2026-06-17.