CVE-2022-3236
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to...
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
- Record
CVE-2022-3236- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2022-42644
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
- Record
EUVD-2022-42644- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jv5x-4hfr-x3p5
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to...
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
- Record
GHSA-jv5x-4hfr-x3p5- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74, CWE-94
- Updated
- 2026-11-02
CISA KEV No score
Sophos Firewall Code Injection Vulnerability
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
- Record
CVE-2022-3236- Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
- Record
CVE-2022-3236- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Sophos Firewall <= 19.0 MR1 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3236 is a critical vulnerability (CVSS 9.8) in Sophos Firewall, published September 23, 2022. CISA lists it as known to be exploited, since September 23, 2022. EUVD reports exploitation since September 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 98.9%, the 99th percentile. No source names a fixed version.