CVE-2022-3236

A critical code injection vulnerability has been identified in the User Portal and Webadmin of Sophos Firewall versions v19.0 MR1 and earlier. This flaw allows an unauthenticated remote attacker to execute arbitrary code on the affected systems. The root cause of this vulnerability lies in improper validation of user input, which can be exploited to inject malicious code into the application. By leveraging this weakness, attackers can gain unauthorized access to the underlying operating system, potentially leading to complete system compromise. The high severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a significant risk to organizations utilizing affected versions of the firewall.

Attack vectors for this vulnerability are primarily web-based, allowing attackers to target the User Portal and Webadmin interfaces. An attacker could craft a specially designed request that exploits the input validation flaw, leading to the execution of arbitrary commands on the server. This could be accomplished through various means, such as sending crafted HTTP requests or utilizing automated tools to probe for the vulnerability. Once the code is executed, the attacker could manipulate the firewall's configurations, exfiltrate sensitive data, or pivot to other internal systems, thereby expanding their control over the network.

The real-world impact of this vulnerability can be severe, particularly for organizations that rely on Sophos Firewall for network security. Successful exploitation could result in unauthorized access to sensitive data, disruption of services, and potential loss of customer trust. The business risks associated with such an incident include financial losses from remediation efforts, legal liabilities, and reputational damage. Additionally, organizations may face regulatory scrutiny if sensitive data is compromised, leading to further financial penalties and operational challenges. The potential for widespread exploitation makes it imperative for organizations to take this vulnerability seriously.

To detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. First and foremost, it is crucial to update to the latest version of Sophos Firewall, which includes patches that address this vulnerability. Regularly applying security updates and patches is a fundamental practice in maintaining a secure environment. Organizations should also conduct thorough security assessments, including vulnerability scanning and penetration testing, to identify any potential weaknesses in their systems. Monitoring network traffic for unusual patterns or unauthorized access attempts can also help in early detection of exploitation attempts.

In addition to technical measures, organizations should invest in employee training and awareness programs to educate staff about the importance of cybersecurity hygiene. This includes recognizing phishing attempts that could lead to exploitation of vulnerabilities and understanding the critical role they play in maintaining the security of the organization's infrastructure. By adopting a proactive security posture and fostering a culture of cybersecurity awareness, organizations can significantly reduce their risk exposure and enhance their overall resilience against potential threats.

CSURFACE threat intelligence has identified a marked escalation in activity related to CVE-2022-3236, coinciding with its recent inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. This formal recognition underscores the vulnerability’s critical severity and elevates its priority for defensive measures. Our telemetry indicates a significant increase in detection events, reflecting growing adversary interest and potential exploitation attempts in the wild. The emergence of a high EPSS score further corroborates the heightened likelihood of exploitation, signaling that threat actors are actively targeting Sophos Firewall instances running vulnerable versions. Although no new exploit variants have been publicly disclosed, the convergence of these factors substantially raises the threat level. Defenders should consider this vulnerability as an immediate and critical risk, given the potential for remote code execution and the expanding attack surface. The updated risk profile necessitates accelerated attention to patch management and monitoring efforts to mitigate the increased exploitation pressure.

Update 2 — July 13, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2022-3236, indicating that adversaries are intensifying their targeting of vulnerable Sophos Firewall instances. This surge in telemetry suggests that exploitation attempts are becoming more frequent, increasing the operational tempo of threat actors leveraging this critical remote code execution vulnerability. Although no new exploit variants or ransomware affiliations have been observed, the heightened detection trend underscores an expanding attack surface and a growing likelihood of successful compromise. Consequently, the threat level for this vulnerability has increased, reinforcing its status as a critical risk that demands continued vigilance in monitoring and response efforts.

Update 3 — August 01, 2026

CSURFACE threat intelligence has identified a marked escalation in activity exploiting the CVE-2022-3236 vulnerability in Sophos Firewall. Our telemetry indicates a significant uptick in attempted intrusions targeting this critical remote code execution flaw, reflecting increased adversary interest and operational momentum. Although no novel exploit techniques or ransomware affiliations have surfaced, the intensified exploitation attempts suggest that threat actors are refining their targeting strategies and expanding their attack campaigns. This development elevates the overall threat posture, as the probability of successful compromise has grown in tandem with the surge in observed activity. Defenders should recognize this heightened exploitation trend as an indicator of increased risk exposure and adjust monitoring priorities accordingly.