Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · EDR and XDR · in CISA KEV

Sophos in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 7 entries for Sophos as of catalog version 2026.11.06, released November 6, 2026. The newest was added February 6, 2025, and the latest federal due date is February 27, 2025. CISA marks 2 of them as known ransomware use.

Updated

entries in the catalog
7
newest addition
February 6, 2025
latest federal due date
February 27, 2025
marked known ransomware use
2

Directory record

Website
www.sophos.com
Categories
EDR and XDR (primary), Firewalls and NGFW, MDR and managed SOC
Headquarters
Oxford, United Kingdom
Founded
Not established
Ownership
Owned by Thoma Bravo since 2020
Company record
Sophos on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “Sophos”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added February 6, 2025

    CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability

    CyberoamOS · known ransomware use

    Due February 27, 2025

  2. Added February 6, 2025

    CVE-2020-15069 Sophos XG Firewall Buffer Overflow Vulnerability

    XG Firewall

    Due February 27, 2025

  3. Added November 16, 2023

    CVE-2023-1671 Sophos Web Appliance Command Injection Vulnerability

    Web Appliance

    Due December 7, 2023

  4. Added September 23, 2022

    CVE-2022-3236 Sophos Firewall Code Injection Vulnerability

    Firewall

    Due October 14, 2022

  5. Added March 31, 2022

    CVE-2022-1040 Sophos Firewall Authentication Bypass Vulnerability

    Firewall

    Due April 21, 2022

  6. Added March 25, 2022

    CVE-2020-25223 Sophos SG UTM Remote Code Execution Vulnerability

    SG UTM

    Due April 15, 2022

  7. Added November 3, 2021

    CVE-2020-12271 Sophos SFOS SQL Injection Vulnerability

    SFOS · known ransomware use

    Due May 3, 2022

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Weekly archive · Oct 6 – Oct 12, 2025

    Security Leadership Shuffles: Exabeam Names New CEO, Sophos Adds Chief Legal Officer

  2. Weekly archive · May 26 – Jun 1, 2025

    DragonForce Ransomware Delivered to MSP Clients via SimpleHelp

  3. Weekly archive · Feb 3 – Feb 9, 2025

    CISA Catalogs Five More Exploited Flaws, Including Microsoft Outlook Bug

  4. Weekly archive · Oct 28 – Nov 3, 2024

    Sophos Details Five-Year Fight Against China-Linked Perimeter Device Attacks

  5. Weekly archive · Oct 21 – Oct 27, 2024

    Sophos to Acquire Secureworks for $859 Million

  6. Weekly archive · Jun 3 – Jun 9, 2024

    Sophos details Crimson Palace, a two-year Chinese espionage campaign

  7. Weekly archive · Nov 13 – Nov 19, 2023

    CISA Flags Sophos, Oracle, and Windows Flaws as Actively Exploited

  8. Weekly archive · Sep 26 – Oct 2, 2022

    Sophos Patches Exploited Firewall RCE Flaw

  9. Weekly archive · Mar 28 – Apr 3, 2022

    Sophos Firewall authentication bypass exploited in South Asia

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for Sophos, published November 8, 2026