What’s Vulnerable › Vulnerabilities

CVE-2020-9363

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-24 · updated 2026-06-17
• Weakness: CWE-436

Description

The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction.

Affected products

• Sophos Cloud Optix: before 2020-01-14 — fixed in 2020-01-14
• Sophos Endpoint Protection: before 2020-01-14 — fixed in 2020-01-14
• Sophos Intercept X Endpoint: before 2020-01-14 — fixed in 2020-01-14
• Sophos Intercept X For Server: before 2020-01-14 — fixed in 2020-01-14
• Sophos Mobile managed on-premises: before 2020-01-14 — fixed in 2020-01-14
• Sophos Secure Web Gateway: before 2020-01-14 — fixed in 2020-01-14

How to fix

Upgrade to a fixed version: Sophos Cloud Optix 2020-01-14; Sophos Endpoint Protection 2020-01-14; Sophos Intercept X Endpoint 2020-01-14; Sophos Intercept X For Server 2020-01-14; Sophos Mobile managed on-premises 2020-01-14; Sophos Secure Web Gateway 2020-01-14. Check the vendor advisory for mitigations.

References

• https://blog.zoller.lu/p/release-mode-coordinated-disclosure-ref.html
• https://community.sophos.com/b/security-blog/posts/sophos-comments-to-cve-2020-9363
• https://blog.zoller.lu/p/release-mode-coordinated-disclosure-ref.html
• https://community.sophos.com/b/security-blog/posts/sophos-comments-to-cve-2020-9363

Get alerted when CVE-2020-9363 or the next vulnerability affects your stack