A path‑traversal flaw in Sophos SG UTM allows a remote, unauthenticated adversary to execute arbitrary code as root. The attacker must sustain repeated attacks for a few minutes, exploiting a race condition that occurs when the email proxy is used with scanning enabled. Successful exploitation results in full system compromise, granting the attacker complete confidentiality, integrity, and availability control over the affected device.

Sophos SG UTM all versions. The system is end‑of‑life, and the vulnerability applies to every variant released before the patch is applied.

The CVSS score of 9.2 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. The attack likely requires remote access to the email proxy interface while scanning is enabled, and repeated access attempts for minutes are necessary to trigger the race condition. This creates a realistic, though somewhat time‑consuming, exploit path.