Is Sophos safe right now?
Nothing new in 90 days
No Sopho flaws have been added to CISA's exploited list in the last 90 days (the most recent was Feb 6, 2025). Keep automatic updates on: that can change any day.
0exploited in the last 30 days
0in the last 90 days
0zero-days in 2026
7on CISA's list, all time
Earlier exploited flaws
- CyberoamOS (CROS) SQL Injection Vulnerability
- Sophos XG Firewall Buffer Overflow Vulnerability
- Sophos Web Appliance Command Injection Vulnerability
- Sophos Firewall Code Injection Vulnerability Zero-day
- Sophos Firewall Authentication Bypass Vulnerability Zero-day
- Sophos SG UTM Remote Code Execution Vulnerability
- Sophos SFOS SQL Injection Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 0 | 0 |
| 2025 | 2 | 0 |
| 2024 | 0 | 0 |
| 2023 | 1 | 0 |
| 2022 | 3 | 2 |
Questions
Is Sophos safe right now?
No Sopho flaws have been added to CISA's exploited list in the last 90 days (the most recent was Feb 6, 2025). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many Sophos vulnerabilities have been exploited?
7 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 2 of them used by ransomware.
Covers products matching sophos. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.