CVE-2022-3226

—

CVSS 3.1

7.2 high

EPSS

2%p77

Published

Dec 1, 2022 (Dec 1, 2022)

Modified

Jun 17, 2026

Description

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.

Vendors: sophos
Products: xg firewall firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.8%)

In the news1 stories

Sophos fixed a critical flaw in its Sophos Firewall version 19.5

Security AffairsDec 7, 07:03 UTC · Dec 7, 2022Exploit / PoC in the wildCVE-2022-3236 CVE-2022-3226 CVE-2022-3713+4 CVEs