Sophos UTM CVE-2026-118633

Exploitation requires the Sophos UTM email proxy to be in use with scanning enabled - this specific feature configuration is the gating precondition, and appliances without it are not affected. Beyond that, no authentication, privileges, or user interaction are needed (PR:N/UI:N), but the attacker must win a race condition, which per the description means sustaining repeated attacks for a few minutes; this timing window (CVSS 4.0 AT:P) makes exploitation probabilistic rather than deterministic and is the primary limiting factor on reliability. The overriding real-world condition is that the product is end-of-life and the patch must be applied manually, so exposure persists until an operator actively installs the fix.

This is a genuine high-priority issue despite the absence of exploitation telemetry. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) combined with full VC:H/VI:H/VA:H impact describes a remote, unauthenticated, no-user-interaction path to arbitrary code execution as root, scored 9.2, and vuln.today assigns the 'act_now' decision label. The one tempering signal is AT:P (attack requirements present), which maps directly to the race condition the description states must be won by sustaining repeated attacks for a few minutes - exploitation is probabilistic rather than single-shot, so reliability and speed are reduced. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 'act_now' priority here is driven by the severity and unauthenticated root outcome, not by observed in-the-wild activity. The critical aggravating factor is that Sophos UTM is end-of-life and the fix must be installed manually - there is no automatic update path, so unpatched appliances will remain exposed indefinitely. Risk is bounded by the requirement that the email proxy be in use with scanning enabled; environments not running that configuration are not exposed.

A remote, unauthenticated attacker repeatedly sends crafted traffic to an exposed Sophos UTM email proxy that has scanning enabled, sustaining the attempts for a few minutes until a path-traversal race condition is won, at which point arbitrary code runs as root on the appliance. No public exploit code is identified in the available data, and success is probabilistic because of the timing race (reflected as AT:P in the CVSS 4.0 vector).