Sophos has patched a path traversal flaw in its end-of-life UTM appliance that lets an unauthenticated attacker run commands as root. There is no workaround, the patch is manual, and routine updates will not deliver it.
What happened
The flaw is tracked as CVE-2026-118633 and sits behind the UTM's email proxy when scanning is enabled. An attacker who keeps a race condition alive for a few minutes can execute arbitrary commands with root privileges. Sophos scored it 9.2 under CVSS 4.0 and 8.1 under CVSS 3.1, and published the advisory on 28 October 2026.
Sam Pizzey of Intruder reported the issue through Sophos' bug bounty programme. Sophos says the flaw is fixed but publishes no fixed build number: UTM is end-of-life, so remediation is an upgrade or a hand-installed patch rather than a normal firmware release.
Who is affected
The CVE record lists every UTM version up to and including 9.724 as affected.
- Any Sophos UTM or SG UTM still running Email Protection with scanning turned on
- Appliances reachable from the internet on mail ports, including NAT rules that forward inbound SMTP to the UTM
- Estates that kept the UTM after moving the firewall role to Sophos Firewall or another vendor
What to do now
Find every UTM still scanning mail, then either install the patch from Sophos support article KBA-000049692 or take the appliance out of the mail path today.
- Inventory UTM appliances and confirm whether the email proxy is enabled with scanning on
- Apply the vendor patch, or migrate the site to a supported Sophos Firewall release
- If neither can happen today, stop forwarding inbound SMTP to the UTM and terminate mail elsewhere
- After patching, review configuration and logs for changes you did not make
What this means for South African businesses
UTM has been past end-of-life for years, and plenty of South African SMEs still run one because it works and nobody wants to fund the migration. That is the risk: an internet-facing appliance with a root-level flaw, no automatic update path and no workaround. The ones most likely to be exposed are the boxes nobody has logged into for a year, still holding the mail flow for a domain that moved to Microsoft 365.
Source: Sophos security advisory sophos-sa-20261028-utm-rce.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.