CVE-2024-12727criticalCWE-89

CVE-2024-12727: critical vulnerability in Sophos Firewall

Published · Updated

Follow this CVE+ Monitor Sophos Firewall

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.4%
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Sophos · Sophos Firewall
Related CVEs — Sophos Firewall

In the same product, most dangerous first.

CVE-2022-1040CRITICALCVE-2022-1040EPSS 99.8%KEVCVE-2022-3236CRITICALCVE-2022-3236EPSS 98.9%KEVCVE-2024-13973MEDIUMCVE-2024-13973EPSS 12.3%CVE-2025-6704CRITICALCVE-2025-6704EPSS 11.8%CVE-2025-7624CRITICALCVE-2025-7624EPSS 10.5%CVE-2024-13974HIGHCVE-2024-13974EPSS 9.1%