Sophos UTM CVE-2026-118633 (sophos-sa-20261028-utm-rce): pre-auth remote code execution as root through the Email Protection proxy, all versions, end-of-life product. How do I patch or mitigate?

What it is: On October 28, 2026 Sophos disclosed CVE-2026-118633, a path traversal flaw in the email proxy of Sophos UTM (the older SG UTM firewall line). An unauthenticated remote attacker can run commands as root if the email proxy has scanning enabled; the attack needs repeated attempts over a few minutes to win a race condition. Sophos rates it critical and lists no workaround. Because UTM is end-of-life, the fix is not delivered through normal Up2Date updates: it is a manual patch described in Sophos knowledge base article KBA-000049692. Sophos did not report exploitation at publication, but a public exploit listing appeared quickly, and firewalls with SMTP open to the internet are easy to find. Am I affected: - Any Sophos UTM / SG UTM appliance or virtual appliance (all versions) that uses Email Protection with the SMTP proxy and scanning enabled. Check in WebAdmin under Email Protection > SMTP whether the proxy is enabled and which interfaces accept mail. - Sophos Firewall (SFOS / XGS) is a different product and is not named in this advisory. Fix: 1. Apply the manual patch from KBA-000049692 on every UTM appliance as soon as possible, following Sophos's steps exactly, and repeat it on HA peers. 2. Plan the migration to a supported Sophos Firewall (Sophos's migration guidance is KBA-000003353) or another supported mail gateway; UTM will not receive regular fixes for future bugs. 3. Until patched: if you can, route inbound mail through another gateway or disable the UTM SMTP proxy; at minimum, allow SMTP to the UTM only from your mail provider's or upstream relay's IP ranges instead of the whole internet. 4. Because the bug gives root, check patched appliances that were exposed: unexpected admin accounts, configuration changes, unknown processes, and outbound connections; restore from a known-good configuration backup if anything looks wrong, and rotate admin and VPN credentials. Verify: the patch steps in KBA-000049692 report success on each appliance, and an external scan shows SMTP to the UTM reachable only from the sources you intend. Sources: https://www.sophos.com/en-us/security-advisories/sophos-sa-20261028-utm-rce https://brandefense.io/security-news/sophos-utm-cve-2026-118633-email-protection-rce-patch/ https://www.strix.ai/cve/CVE-2026-118633