Sophos UTM vulnerability CVE-2026-118633: unauthenticated code execution, manual patch to install

The short answer: on 28 October 2026, Sophos released a patch for CVE-2026-118633, a critical flaw in Sophos UTM. A remote attacker, without authentication, can run commands with root privileges on the appliance when the email proxy is used with scanning enabled. Sophos UTM is end-of-life, so the patch is not installed automatically: it must be applied by hand, following support article KBA-000049692. If your UTM still filters your email, do it now, and move the appliance replacement to the top of the list.

In Morocco, many SMEs still run a Sophos UTM or an SG appliance, sometimes as the SMTP gateway in front of their mail. Here is what the vendor and Morocco’s maCERT (DGSSI) say, and what to do about it.

What is affected

Product	Affected versions	Fix
Sophos UTM with the email proxy and scanning enabled (Email Protection)	all versions according to Sophos; versions earlier than 9.724 according to the maCERT bulletin	patch to install manually (Sophos KBA-000049692)
Sophos UTM without Email Protection	all versions according to Sophos, but the advisory ties the attack to the email proxy	patch recommended; plan the migration
Sophos Firewall (SFOS, XGS appliances)	not mentioned in the advisory	no action related to this alert

Sources: Sophos advisory sophos-sa-20261028-utm-rce of 28 October 2026 and maCERT bulletin 70252910/26 of 29 October 2026. The Sophos advisory gives no fixed version number: it points to the installation procedure in its support article.

What Sophos describes: a path traversal flaw. The attacker can run commands as root after winning a race condition by sustaining repeated attempts for a few minutes. The flaw was reported by an external researcher, Sam Pizzey, through the Sophos bug bounty programme.

Severity and exploitation

• Published severity: Sophos rates the flaw “critical”. The advisory does not publish a CVSS score.
• Exploitation: the Sophos advisory does not mention any exploitation. CVE-2026-118633 was not in the CISA KEV catalogue of exploited vulnerabilities, in its 30 October 2026 version.
• maCERT: bulletin 70252910/26 of 29 October 2026, titled “Vulnérabilité critique dans Sophos UTM”, rates risk and impact as critical. It states that the flaw concerns Sophos UTM configured as an SMTP gateway.
• Workaround: none, according to Sophos.

Why it matters despite no known exploitation: a UTM acting as a mail gateway accepts connections from any server on the internet. Root access on that appliance gives control of the firewall itself, the VPNs, the rules and user traffic. And now that the advisory is public, so is the description of the attack.

The end-of-life paradox

Our guide to Sophos UTM end of life made the point: since 30 June 2026, UTM receives no more system updates, and Sophos provides no support beyond 31 December 2026. This patch is an exception, and Sophos says so plainly: “Sophos UTM is end-of-life and the patch must be installed manually”. The only other path it offers is moving to Sophos Firewall.

In practice, do not count on such an exception for the next flaw. An appliance that relies on one-off manual patches is no longer reliable protection.

Interim measures

If the patch cannot be installed immediately:

1. Back up the UTM configuration before any change.
2. Check whether Email Protection is actually in use: active SMTP proxy, antispam and antivirus scanning of messages. If the feature is no longer needed, disabling it reduces the exposure Sophos describes.
3. Restrict who can connect to the UTM’s SMTP port where your architecture allows, for example to the addresses of your filtering service or mail provider only.
4. Restrict the administration interface (WebAdmin) and the user portal to the internal network.
5. Plan the exit from UTM: move email filtering to your mail platform (Microsoft 365, Google Workspace) or a dedicated service, and replace the firewall.

Checks to run

• List all your UTMs, including standby appliances, secondary sites and virtual instances.
• Confirm the patch is installed on each one, following the KBA-000049692 procedure.
• Review the SMTP logs for the past few days: bursts of repeated connections from the same address, unusually numerous or long sessions.
• Check administrator accounts and firewall rules: any unknown account or rule must be investigated.
• If in doubt, treat the appliance as compromised: change administrator passwords and VPN secrets, then follow our incident response plan for the first hour.

Our take for businesses in Morocco

This alert shows the concrete risk of an end-of-life device left on the front line. It also hits email, already the main vector for business email compromise and payment fraud. For organisations in scope, law 05-20 and the DGSSI requirements require maCERT bulletins to be acted on. Our patch management method helps make sure no appliance is forgotten.

For the replacement, our business firewall buying guide for Morocco and our Sophos vs WatchGuard comparison set out the options.

How we can help

To be transparent: ALLSAFE SOLUTIONS is not a Sophos partner. To stay with Sophos by moving to Sophos Firewall, a Sophos partner will support you. We can, however, inventory your UTMs, check their exposure and Email Protection usage, and prepare the migration to a FortiGate, as a Fortinet integrator in Morocco, or to a Firebox, as a WatchGuard partner in Morocco, with email filtering moved to the right place. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes.

Discover our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: Sophos security advisory sophos-sa-20261028-utm-rce, maCERT bulletin 70252910/26, CVE-2026-118633 record, NVD CVE-2026-118633, CISA KEV catalogue.