CVE-2022-3236 Sophos Firewall Code Injection

Exploited in the wild Critical 9.8 Published 23 Sep 2022 Updated 7 Oct 2026

Remote attackers can execute arbitrary code via the User Portal and Webadmin interfaces in Sophos Firewall.

Exploited in the wild: Since 23 Sep 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-3236?

CVE-2022-3236 is a critical code injection vulnerability in Sophos Firewall, published on 23 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

Weakness: CWE-94

Which versions are affected by CVE-2022-3236?

It affects 1 product.

Products include Sophos Firewall.

How do I fix CVE-2022-3236?

No fix has been published for CVE-2022-3236 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Oct 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-3236 being exploited?

Yes. Attackers have exploited CVE-2022-3236 in the wild since at least 23 Sep 2022.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-jv5x-4hfr-x3p5.