https://patchfirst.co/vendor/sophos/New and newly exploited Sophos CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2020-29574/CVE-2020-29574#kevThu, 06 Feb 2025 00:00:00 GMTSophos · CyberoamOS. In CISA KEV since 2025-02-06, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.7% (higher than 91.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1055 Process Injection; T1059 Command and Scripting Interpreter. Priority 73.2 of 100.kevransomwareT1055T1059https://patchfirst.co/cve/CVE-2020-15069/CVE-2020-15069#kevThu, 06 Feb 2025 00:00:00 GMTSophos · XG Firewall. In CISA KEV since 2025-02-06. ENISA EUVD lists it as exploited. EPSS 10.7% (higher than 95.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 64.0 of 100.kevT1190T1059https://patchfirst.co/cve/CVE-2023-1671/CVE-2023-1671#kevThu, 16 Nov 2023 00:00:00 GMTSophos · Web Appliance. In CISA KEV since 2023-11-16. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2022-3980/CVE-2022-3980Wed, 16 Nov 2022 00:00:00 GMTSophos · Sophos Mobile managed on-premises. Not in CISA KEV. EPSS 9.8% (higher than 95.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 66.0 of 100.public-exploithttps://patchfirst.co/cve/CVE-2022-3236/CVE-2022-3236#kevFri, 23 Sep 2022 00:00:00 GMTSophos · Firewall. In CISA KEV since 2022-09-23. ENISA EUVD lists it as exploited. EPSS 98.9% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2022-1040/CVE-2022-1040#kevThu, 31 Mar 2022 00:00:00 GMTSophos · Firewall. In CISA KEV since 2022-03-31. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1040 Network Sniffing; T1078 Valid Accounts; T1557 Adversary-in-the-Middle; T1574 Hijack Execution Flow. Priority 79.9 of 100.kevpublic-exploitT1190T1059T1040T1078T1557T1574https://patchfirst.co/cve/CVE-2020-25223/CVE-2020-25223#kevFri, 25 Mar 2022 00:00:00 GMTSophos · SG UTM. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 96.8% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2020-12271/CVE-2020-12271#kevWed, 03 Nov 2021 00:00:00 GMTSophos · SFOS. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 42.4% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.6 of 100.kevransomwarepublic-exploitT1190T1059