CISA KEV + NVD
Sophos flaws exploited in the wild
7 Sophos vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
In numbers
- 7 exploited flaws, listed from 3 Nov 2021 to 6 Feb 2025
- 2 used in ransomware campaigns
- 7 scored critical by NVD
- 386 days: median gap between NVD publication and the KEV listing, leaving out the 1 listed on the catalog’s first day; 2 were listed within a week
All exploited Sophos flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2020-29574CyberoamOS (CROS) SQL Injection Vulnerability | CyberoamOS | 11 Dec 2020 | 6 Feb 20251518 days laterUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2020-15069Sophos XG Firewall Buffer Overflow Vulnerability | XG Firewall | 29 Jun 2020 | 6 Feb 20251683 days later | 9.8 Critical | Vendor |
| CVE-2023-1671Sophos Web Appliance Command Injection Vulnerability | Web Appliance | 4 Apr 2023 | 16 Nov 2023226 days later | 9.8 Critical | Vendor |
| CVE-2022-3236Sophos Firewall Code Injection Vulnerability | Firewall | 23 Sep 2022 | 23 Sep 2022same day or before NVD | 9.8 Critical | Vendor |
| CVE-2022-1040Sophos Firewall Authentication Bypass Vulnerability | Firewall | 25 Mar 2022 | 31 Mar 20226 days later | 9.8 Critical | — |
| CVE-2020-25223Sophos SG UTM Remote Code Execution Vulnerability | SG UTM | 25 Sep 2020 | 25 Mar 2022546 days later | 9.8 Critical | — |
| CVE-2020-12271Sophos SFOS SQL Injection Vulnerability | SFOS | 27 Apr 2020 | 3 Nov 2021555 days laterUsed in ransomware | 9.8 Critical | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.