Sophos Firewall - RCE (CVE-2022-3236)
Description
Sophos Firewall is vulnerable to code injection in the User Portal and Webadmin components, allowing a remote unauthenticated attacker to execute arbitrary code on the affected device.
psychologyCrowdSec Analysis
CVE-2022-3236 is a critical code injection vulnerability in Sophos Firewall affecting the User Portal and Webadmin components. Unauthenticated remote attackers can exploit this flaw to execute arbitrary code on the firewall, potentially gaining full control of the device.
CrowdSec has been tracking this vulnerability and its exploits since 12th of March 2026.
CrowdSec network observations suggest that most exploitation of CVE-2022-3236 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2022-3236 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attackers exploit the /userportal/Controller or /webconsole/Controller endpoints by sending crafted POST requests with the json body parameter containing shell injection payloads (backtick or $() in the _discriminator.curvalue field.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-09-23 |
| CISA KEV | 2022-09-23 |
| CISA Remediation Deadline | 2022-10-14 |
| Rule Released | 2026-03-12 |
| CrowdSec First Seen | 2026-03-13 |