# Sophos Firewall RCE flaws patched pre-auth SQL injection

Published: 2026-06-09 · Severity: routine · Sectors: government-national, financial-services, technology
Canonical: https://vorant.io/reports/31b0eeb4-3edd-549a-97c1-ad735452e08d/sophos-firewall-rce-flaws-patched-pre-auth-sql-injection

> Three Sophos Firewall vulnerabilities allow pre-auth and post-auth remote code execution; no active exploitation reported.

Sophos has disclosed three vulnerabilities in Sophos Firewall v21.0 GA and older versions. The most critical is CVE-2024-12727, a pre-authentication SQL injection flaw in the email protection feature that can lead to unauthenticated remote code execution and unauthorized system access. CVE-2024-12729 is a post-authentication code injection vulnerability in the User Portal requiring authenticated access to achieve RCE. CVE-2024-12728 is a lower-severity privilege exposure issue where SSH credentials for High Availability cluster initialization remain active after HA setup, potentially exposing privileged accounts. The advisory reports no current exploitation in the wild. Defenders using affected Sophos Firewall versions should prioritize patching immediately, with emphasis on the pre-auth SQL injection which requires no authentication. Sophos has released updates; testing and deployment should proceed urgently given the critical nature of firewall compromise.

## Mentioned in this report

- Vulnerabilities: CVE-2024-12727, CVE-2024-12728, CVE-2024-12729

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sophos-firewall-could-allow-for-remote-code-execution_2024-140

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/31b0eeb4-3edd-549a-97c1-ad735452e08d/sophos-firewall-rce-flaws-patched-pre-auth-sql-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup