CVE-2022-3226

7.2 highEPSS 1.8%

High (7.2) in sophos xg firewall firmware. EPSS 1.8% chance of exploitation in the next 30 days.

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-12-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sophos:xg_firewall_firmware

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0

Check your stack JSON