CVE-2025-6704

Critical · 9.8

CVSS

9.8

EPSS

11.8%

Published

Jul 21, 2025

CISA due date

—

The record

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode.

Affected packages

Ecosystem	Package	Introduced	Fixed