# CVE-2022-3236: Sophos Firewall - RCE

> Live exploitation tracking for CVE-2022-3236 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-3236

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Sophos Firewall
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** firewall

## Description

Sophos Firewall is vulnerable to code injection in the User Portal and Webadmin components, allowing a remote unauthenticated attacker to execute arbitrary code on the affected device.

## CrowdSec analysis

[CVE-2022-3236](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-3236) is a critical code injection vulnerability in Sophos Firewall affecting the User Portal and Webadmin components. Unauthenticated remote attackers can exploit this flaw to execute arbitrary code on the firewall, potentially gaining full control of the device.

CrowdSec has been tracking this vulnerability and its exploits since 12th of March 2026.

CrowdSec network observations suggest that most exploitation of CVE-2022-3236 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2022-3236 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the `/userportal/Controller` or `/webconsole/Controller` endpoints by sending crafted POST requests with the `json` body parameter containing shell injection payloads (backtick or `$(`) in the `_discriminator.curvalue` field.

## Timeline

- 2022-09-23: CVE Published. CVE-2022-3236 is published to NVD.
- 2022-09-23: CISA KEV. CVE-2022-3236 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-10-14: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-03-12: Rule Released. CrowdSec releases a rule to detect CVE-2022-3236 exploitation attempts against the CrowdSec Network.
- 2026-03-13: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-3236 for the first time.

## References

- https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce
- https://nvd.nist.gov/vuln/detail/CVE-2022-3236
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3236.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-3236) follows observed exploitation activity for CVE-2022-3236. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.