Sophos has released a patch for a critical flaw in its retired UTM product that could let an attacker who is not logged in run commands as root, but owners must install the fix by hand because the product no longer receives automatic updates.

The flaw, tracked as CVE-2026-118633, is covered by Sophos security advisory sophos-sa-20261028-utm-rce, dated 28 October 2026. Sophos rates the issue critical and calls for urgent action from customers still using UTM for Email Protection.

How the flaw works

According to the advisory summary, the flaw sits in the email path. An attacker must win a race condition by keeping up repeated attempts for a few minutes, and the attack works when the email proxy is in use with scanning switched on. UTM devices still used for Email Protection, filtering inbound mail for an organisation, are therefore the ones at risk.

A UTM used only as a firewall, with the email proxy off, is not in the scenario Sophos describes, although the advisory lists all versions as affected. The flaw was reported through Sophos's bug bounty programme by researcher Sam Pizzey.

Why a manual patch matters

Sophos UTM reached end of life on 30 June 2026, and most customers have migrated to Sophos Firewall, according to Sophos. Because the product is retired, the patch is not delivered automatically. Sophos gives two remedies: upgrade to a supported version of Sophos Firewall, or follow the manual patch installation instructions in Sophos support article KBA-000049692.

Sophos does not publish a fixed build number in the advisory, so the knowledge base article is the reference for confirming the patch is in place. Sophos does not say whether the flaw has been exploited in the wild, and this article makes no such claim.

Sources: Sophos Community; Trustlist