Loading story…
Sophos released security updates for Sophos Firewall to remediate three vulnerabilities affecting version 21.0 GA (21.0.0) and earlier, including two critical issues tracked as CVE-2024-12727 and CVE-2024-12728. According to public advisories, CVE-2024-12727 is an SQL injection flaw in the email protection feature that can expose the internal firewall database and, under specific HA and SPX conditions, lead to remote code execution. CVE-2024-12728 stems from an improperly handled SSH password used during HA cluster initialization that remains active after setup, potentially enabling unauthorized system access.
A third flaw, CVE-2024-12729, affects the User Portal and allows an authenticated remote attacker to perform command injection and achieve remote code execution. Sophos said devices with automatic hotfix installation enabled receive the fixes automatically, and the company published guidance for administrators to verify whether the hotfixes have been applied successfully. Organizations running affected firewall versions have been urged to confirm patch status promptly because the vulnerabilities impact perimeter security infrastructure and could expose management access or enable code execution on the device.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Sophos published support guidance explaining how administrators can verify whether hotfixes for CVE-2024-12727, CVE-2024-12728, and CVE-2024-12729 have been applied. The guidance complements Sophos's statement that devices with automatic hotfix installation enabled are patched automatically.
Sophos released security updates for Sophos Firewall to fix CVE-2024-12727, CVE-2024-12728, and CVE-2024-12729. The flaws affect version 21.0 GA (21.0.0) and earlier and can enable unauthorized access, command injection, and remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos disclosed and remediated three high-severity local privilege escalation vulnerabilities in **Sophos Endpoint and Workload Protection for Windows**, **Sophos Central Device Encryption**, and the Windows installer, tracked as `CVE-2024-13972`, `CVE-2025-7433`, and `CVE-2025-7472`. The flaws could allow a local user to gain **SYSTEM** privileges, and `CVE-2025-7433` could also enable arbitrary code execution. Sophos said customers using the default **Recommended** update policy generally received fixes automatically, while organizations on **FTS**, **LTS**, or using older installer packages must upgrade manually and, for installer-related exposure, download a fresh installer from Sophos Central. Details published on `CVE-2025-7433` describe a **CWE-502 deserialization of untrusted data** issue in the encryption service of Sophos Intercept X for Windows with Central Device Encryption, affecting versions prior to **2025.1** and allowing crafted serialized payloads to run code as **SYSTEM** during configuration, policy, or inter-process message handling. Sophos said fixes are available in **FTS 2024.3.2** and later and **LTS 2024.1.1.50** and later. The disclosure follows an earlier Device Encryption privilege-escalation bug, `CVE-2024-8885`, which allowed arbitrary file writing in version **2024.2.0** and older and was fixed in **2024.2.1.6**; Sophos credited external researchers including **Filip Dragovic** of MDSec, **Sina Kheirkhah** of watchTowr, and **Sandro Poppi** via its bug bounty program.
Jun 29, 2026
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026
SonicWall disclosed active exploitation of two vulnerabilities in **SMA1000-series SSL VPN appliances**: `CVE-2026-83548`, a critical pre-authentication server-side request forgery (SSRF) flaw with a CVSS score of 10.0, and `CVE-2026-83549`, a high-severity post-authentication OS command-injection flaw. The SSRF issue stems from an unintended forward-proxy access path in the Work Place interface and may enable unauthenticated attackers to reach internal resources or potentially execute commands; the command-injection flaw enables authenticated administrators to run arbitrary operating-system commands through the Appliance Management Console. SonicWall has issued hotfix firmware and urged customers to apply it immediately. Organizations operating affected appliances should restrict access to the Work Place and administrative interfaces, monitor appliances for anomalous outbound connections, and review administrator activity and appliance logs for indicators of compromise.
Sep 8, 2026