CVE-2020-12271
Actively exploited. CVE-2020-12271 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
CSIRTS triage
- What
- There is a SQL injection vulnerability that may allow remote code execution and exfiltration of sensitive information.
- Who is affected
- Deployments of Sophos Firewall operating system (SFOS) with exposed administration or User Portal services on the WAN zone are affected.
- Urgency
- Remediation is urgent due to successful exploitation being possible and the critical severity of the vulnerability.
- Action
- Apply the latest firmware update to mitigate the vulnerability.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2020-12271
Get an email if CVE-2020-12271 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all EPSS-scored CVEs.
Advisory coverage (1)
- criticalexploitedCVE-2020-12271: Sophos SFOS SQL Injection Vulnerabilitycisa-kev · 2021-11-03
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2020-12271)