CVE-2022-3980

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-16 · updated 2026-06-17
Weakness: CWE-611

Description

An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.

Affected products

Sophos Mobile managed on-premises: from 5.0.0 before 9.7.5 — fixed in 9.7.5

How to fix

Upgrade to a fixed version: Sophos Mobile managed on-premises 9.7.5. Check the vendor advisory for mitigations.

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee
https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee

Get alerted when CVE-2022-3980 or the next vulnerability affects your stack