CVE-2022-1040

What it actually does

CVE-2022-1040 is a network-exploitable authentication bypass in the Sophos Firewall User Portal and Webadmin interfaces in Sophos SFOS v18.5 MR3 and older. A remote, unauthenticated attacker who can reach either exposed web interface can bypass normal login controls and execute arbitrary code on the firewall. Because the vulnerable component runs on the security appliance itself, successful exploitation can compromise confidentiality, integrity, and availability of the firewall and may allow modification of firewall rules, VPN settings, users, certificates, or other security controls.

Why it matters to the business

This is a critical perimeter-device vulnerability with confirmed exploitation in the wild, a very high EPSS likelihood, and inclusion in CISA KEV with a remediation deadline that has long passed. If left exposed, an attacker can take control of a firewall without credentials, disrupt network connectivity, weaken security policy, steal sensitive configuration or credential material, and use the device as a trusted foothold for internal reconnaissance or follow-on attacks. Because Sophos Firewall often protects internet-facing access paths, compromise can have broad operational impact across remote access, branch connectivity, and network segmentation.

How an attack unfolds

An attacker first identifies Sophos Firewall appliances with the User Portal or Webadmin interface reachable from the internet or another untrusted network. They send crafted HTTP or HTTPS requests to the vulnerable portal endpoint that abuse the authentication bypass condition, causing the firewall to treat the request as authorized without valid credentials. The attacker then invokes functionality that leads to command or code execution on the appliance. After gaining execution, they may deploy persistence, create or modify administrator accounts, alter firewall or VPN configuration, disable logging or inspection features, collect configuration and secrets, and use the firewall’s trusted network position to pivot into protected networks. This vulnerability has been actively exploited in the wild and should be treated as a likely compromise scenario for any unpatched, externally exposed appliance.

How to fix it

Apply the Sophos-provided hotfix or upgrade Sophos Firewall to a release newer than v18.5 MR3 that contains the vendor fix. If automatic hotfix installation is available, ensure it is enabled and confirm the relevant hotfix was successfully applied. Where immediate patching is not possible, disable WAN/internet access to both the User Portal and Webadmin interfaces, restrict administrative access to trusted management networks or VPN-only access, and enforce source-IP allowlisting for any required management exposure. Review all administrator accounts, VPN settings, firewall policies, NAT rules, certificates, and scheduled tasks after remediation because patching removes the vulnerability but does not undo changes made by an attacker.

How to confirm the fix worked

Confirm the appliance is not running Sophos SFOS v18.5 MR3 or older, or that the vendor hotfix for this vulnerability is installed. Validate from an external network perspective that Webadmin and User Portal are not reachable from untrusted networks unless explicitly required and tightly restricted. Check the firewall’s update and hotfix status in the management interface or CLI, and verify that no failed or pending hotfix state remains. Perform a non-exploitative web check to confirm unauthenticated requests to User Portal and Webadmin endpoints are rejected, redirected to login, or otherwise denied. Reconcile configuration baselines before and after patching to identify unexpected administrator accounts, firewall rules, VPN users, certificates, or access policy changes.

Typical attack path

1. Scan the internet or target network ranges for Sophos Firewall User Portal or Webadmin interfaces.
2. Confirm that the appliance is running Sophos SFOS v18.5 MR3 or an older vulnerable release, or attempt exploitation opportunistically.
3. Send crafted unauthenticated HTTP/HTTPS requests to the vulnerable User Portal or Webadmin endpoint.
4. Bypass authentication and trigger code execution on the firewall appliance.
5. Establish persistence or deploy tooling on the appliance.
6. Modify firewall, NAT, VPN, administrator, or access-control settings to support continued access.
7. Harvest configuration data, credentials, certificates, VPN material, or network information.
8. Use the compromised firewall as a foothold to access internal systems or disrupt network operations.

How to detect it

Investigate both network telemetry and appliance-local evidence. Review web access logs, administrative audit logs, authentication logs, system logs, and configuration-change history on the Sophos Firewall for unauthenticated or unusual requests to User Portal and Webadmin endpoints, especially shortly before unexpected administrator activity or configuration changes. Look for inbound HTTP/HTTPS requests from unfamiliar external IPs to `/webconsole/` or `/userportal/`, requests that result in server errors or unusual redirects, and bursts of requests followed by shell execution, process creation, account creation, VPN changes, firewall-rule changes, or log clearing. Examine appliance file systems and process listings for unexpected scripts, binaries, webshell-like files, reverse shells, cron jobs, modified startup scripts, or recently changed files outside normal update windows. Correlate firewall events with upstream proxy, IDS/IPS, NetFlow, VPN, and EDR telemetry for outbound connections from the firewall to unknown infrastructure after the suspected exploitation time. Because successful exploitation may grant control of the firewall, absence of logs is not proof of safety; prioritize preserved backups, remote syslog, and external network telemetry.

• /webconsole/Controller
• /userportal/Controller
• /webconsole/
• /userportal/
• POST /webconsole/Controller
• POST /userportal/Controller
• GET /webconsole/Controller
• GET /userportal/Controller
• Sophos Firewall v18.5 MR3
• SFOS 18.5.3
• /log/admin.log
• /log/system.log
• /log/applog.log
• /log/tomcat.log

What your security team should do

• Treat any internet-exposed Sophos Firewall running v18.5 MR3 or older as potentially compromised until reviewed.
• Immediately apply the Sophos hotfix or upgrade to a fixed SFOS release newer than v18.5 MR3.
• Remove direct WAN exposure of Webadmin and User Portal wherever possible; require VPN, trusted management networks, and source-IP restrictions.
• Prioritize incident response review because the vulnerability is in CISA KEV, exploitation is active in the wild, and the remediation deadline has passed.
• Collect and preserve firewall logs before rebooting, upgrading, or factory resetting the appliance.
• Review administrator accounts, MFA settings, VPN configuration, firewall/NAT rules, certificates, and scheduled jobs for unauthorized changes.
• Rotate credentials and secrets that may have been stored on or accessible through the firewall, including local admin passwords, VPN credentials, API keys, and certificates where appropriate.
• Hunt for suspicious inbound requests to Sophos Firewall User Portal and Webadmin endpoints, especially from unknown internet sources.
• If compromise is suspected, follow vendor incident-response guidance and consider rebuilding the appliance from trusted media or restoring only verified-clean configuration.