CVE-2024-12727

9.8 criticalEPSS 1.4%

Critical (9.8) in sophos firewall firmware. EPSS 1.4% chance of exploitation in the next 30 days.

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-12-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sophos:firewall_firmware

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce

Check your stack JSON