Is CVE-2026-118633 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-118633?

CVE-2026-118633 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-118633

Description

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.