Sophos Firewall Code Injection Vulnerability (CVE-2022-3236)
Published In CISA KEV since Sources: SingCERT, CVE.org
- Actively exploited
- Source: CSA/SingCERT How we classify
What is affected, what to do
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution (RCE) by an unauthenticated attacker. This vulnerability enables full control over the affected system and is actively exploited in ransomware campaigns since September 2022. All versions of Sophos Firewall up to and including v19.0 MR1 are affected. Immediate patching to the latest version is critical to mitigate this vulnerability.
The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Sophos Firewall
lte *..19.0.1
- Sophos Firewall
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
9.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
9.8
CVSS v3
Severity Critical on the scale from 0 to 10.
Source: SingCERT, CVE.org
98.9 %
EPSS score
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Source: FIRST EPSS, percentile 99.93
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 230.28 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploitedSource: CSA/SingCERT How we classify
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 9.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 9.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 98.9 %
- High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 99.93
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- CISA assessment (SSVC)
- Exploitation: active · not automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 28 January 2025
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-94
Response and mitigation
Why act now?
Prioritisation rationale
This flaw can be exploited over the network with no authentication and no user interaction, and it gives full code execution on a perimeter device. It ranks among the CVEs most likely to be exploited of all. Attackers use firewall bugs like this to plant persistent footholds at the network edge, harvest credentials and pivot into internal networks; observed attacks were targeted at a small set of selected organisations. CISA does not list known ransomware use, but that does not lower the urgency. Treat any Sophos Firewall with Webadmin or the User Portal reachable from the WAN as a critical emergency requiring same-day action. Internal-only instances with a confirmed hotfix rank high and should be remediated, including a compromise assessment, in the next maintenance window.
Runbook step 1
Immediate response (0-24 h)
- Check exposure and close it now: Determine whether the User Portal or Webadmin is reachable from the WAN/internet (Device Access → WAN zone). If so, remove WAN access immediately. Default ports are TCP/4444 for Webadmin and TCP/443 for the User Portal; verify the ports actually configured on each appliance.
- Verify hotfix status: Sophos Firewall v19.0 MR1 and older are affected. Sophos has released a hotfix and a fixed release; look up the exact version in the Sophos security advisory. Confirm that "Allow automatic installation of hotfixes" is enabled and that the hotfix is actually applied (Backup & firmware → Hotfix). Move any end-of-support version to a supported release.
- Assess for compromise before trusting the box: Treat any appliance that was internet-exposed before patching as potentially compromised. Preserve a config snapshot and the system, admin and authentication logs before making changes, and engage Sophos Support for an integrity check.
- Rotate credentials: Reset or reissue all firewall admin accounts, local User Portal accounts, stored VPN PSKs, certificates and any LDAP/AD bind accounts configured on the firewall. The firewall is a trust anchor with directory access.
- Purge admin accounts: Remove unknown or recently created administrators, API accounts and Device Access exceptions, and reconcile them against change records.
Runbook step 2
Mitigation layers
- Network segmentation: Make Webadmin reachable only from a dedicated management VLAN or jump host. Limit Device Access for Webadmin to the LAN/management zone and use a local service ACL exception to restrict it to fixed admin IPs.
- Minimise the User Portal: Disable the User Portal entirely if it is not strictly required (e.g. for VPN client downloads). Otherwise expose it only over VPN, never directly to the WAN.
- Upstream filtering: If exposure is unavoidable for business reasons, put an upstream perimeter ACL or reverse proxy with geo and IP allowlisting in front of it. Enable available IPS signatures for CVE-2022-3236 (Suricata/ET or vendor IPS patterns); look up the signature IDs in the relevant feed.
- Egress from the firewall itself: Restrict connections initiated by the appliance itself (not forwarded traffic) to the destinations it needs (Sophos update servers, NTP, DNS, SIEM). This blocks unexpected callbacks and makes them visible.
- IAM/least privilege: Enforce MFA for Webadmin and User Portal logins, use minimal-rights admin profiles and shorten session timeouts. This won't stop the injection, but it limits the follow-on damage.
- Off-box logging: Forward system and admin logs via syslog to the SIEM so that post-exploitation log tampering on the box does not erase the evidence.
Runbook step 3
Detection rules
- Web request anomalies: HTTP POST requests from untrusted sources to
/webconsole/Controlleror/userportal/Controllercarrying unusually large or malformed JSON parameters. SPL shape:index=fw sourcetype=sophos:xg (uri="*/webconsole/Controller*" OR uri="*/userportal/Controller*") NOT src_ip IN (<admin_nets>) | stats count by src_ip, uri. - Network telemetry (Zeek/Suricata): Inbound WAN sessions to the Webadmin port (default TCP/4444) or the User Portal. Also flag outbound connections sourced from the firewall's own IP to unknown destinations, especially reverse shells, odd ports or HTTP downloads shortly after inbound portal requests.
- Configuration changes: Watch the admin log for new administrator accounts, modified Device Access rules, new firewall/NAT rules or disabled logging targets outside change windows. Sigma shape:
logsource: product=sophos_firewall, category=admin; detection: event_type in (user_add, rule_change) and src_ip not in admin_nets. - Internal lateral movement: Connections from the firewall IP to internal hosts (SMB/445, RDP/3389, LDAP/389), and unusual LDAP binds using the firewall service account (Windows Event ID 4624/4625 for the bind account, with the firewall as logon source).
- Integrity indicators: Unexpected reboots, service crashes in the system logs, or differences when comparing pre- and post-incident config backups. Load the IoCs published in the Sophos advisory into the SIEM.
- Web request anomalies: HTTP POST requests from untrusted sources to
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Source: CSA/SingCERT, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
| Affected versions | Fixed in | ||
|---|---|---|---|
| Sophos | Sophos Firewall |
|
|
| sophos | firewall |
|
|
Vendors and products
Weakness classes (CWE)
CWE-94Improper Control of Generation of Code ('Code Injection')
Base
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Entry at MITRE CWE-94
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited | |
| CSA/SingCERT | [Updated] Multiple Vulnerabilities in Sophos Firewall (opens in a new tab)CSA/SingCERT | actively exploited |
References & sources
- sophos.comen-us/security-advisories/sophos-sa-20220923-sfos-rcex_refsource_CONFIRM, Vendor advisory
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236government-resource, US government resource
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2022-3236"><img src="https://intel.neosec.eu/badge/cve/CVE-2022-3236.svg?lang=en" alt="CVE-2022-3236 – NEOSEC Intel" height="20"></a>