---
id: CVE-2022-3236
title: >-
  A code injection vulnerability in the User Portal and Webadmin allows a remote
  attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
summary: >-
  A code injection vulnerability in the User Portal and Webadmin allows a remote
  attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Sophos
product: Sophos Firewall
affected:
  - firewall >= unspecified <= 18.5 MR4
  - firewall >= unspecified <= 19.0 MR1
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-01-28T21:40:50.761466Z'
exploited: true
exploitAvailable: true
published: '2022-09-23'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T17:39:46.242Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-3236'
references:
  - url: >-
      https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce
tags:
  - cve.org
  - in-the-wild
  - exploit-available
  - kev
epss: 0.98905
epssPercentile: 0.99927
kev: true
kevDateAdded: '2022-09-23'
kevDueDate: '2022-10-14'
kevRansomware: false
exploits:
  nuclei:
    - CVE-2022-3236
  checkedAt: '2026-10-07T18:42:55.499Z'
zeroDay: true
ingestedAt: '2026-10-07T18:42:20.913Z'
---

## Overview

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

## Affected

- `firewall >= unspecified <= 18.5 MR4`
- `firewall >= unspecified <= 19.0 MR1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.