CVE-2022-1040 is an authentication bypass vulnerability in Sophos Firewall. CISA added it to the Known Exploited Vulnerabilities catalogue on 31 March 2022, which means attackers have used it in real attacks. An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
What this vulnerability means in practice
CVE-2022-1040 is dangerous because an authentication bypass in a perimeter firewall can collapse the trust boundary that protects internal services. When the login control in the User Portal and Webadmin is bypassed, the product stops behaving like a gatekeeper and can become a direct route into administrative functions and, in this case, remote code execution.
That combination matters because firewall compromise is rarely isolated to the firewall itself. A successful bypass can expose network policy, management functions, and any connected environment that assumes the device is enforcing access correctly. Readers should treat the KEV listing as a sign that exploitation was not theoretical, and should use the vendor advisory and the CVE Program and NIST National Vulnerability Database for authoritative patch and exposure details.
How this kind of firewall flaw is exploited
Authentication bypass vulnerabilities are attractive because they remove the attacker’s need to know valid credentials before reaching privileged functionality. On a firewall or security appliance, that often means the attacker is not trying to break a business application, but to reach the management plane that controls routing, filtering, logging, and sometimes broader administrative access.
Once that boundary is crossed, the attacker may be able to execute commands, alter security settings, create persistence, or pivot deeper into the network. For that reason, a flaw like this should be understood as both an access-control failure and a potential initial foothold for broader compromise.
Exposure and remediation priorities
Organisations should first determine whether any Sophos Firewall assets are deployed, where they are exposed, and whether management interfaces are reachable from the internet or from other untrusted networks. The key question is not only whether the product exists, but whether the vulnerable service path is present in the environment and whether the device is still trusted as an enforcement point.
Where remediation is delayed, compensating controls should focus on reducing reachability, restricting administrative exposure, and increasing monitoring around the firewall itself. The broader lesson is to treat perimeter devices as high-value assets whose compromise can invalidate other trust assumptions, not just as another network appliance.
Detection and post-incident review
After patching, organisations should review the device for signs of misuse rather than assuming the vulnerability was never exploited. That includes checking administrative logs, unexpected configuration changes, new accounts or sessions, and any signs that the firewall was used to stage follow-on access.
If exploitation is suspected, the review should extend to adjacent systems that may have been reachable through the firewall during the exposure window. When a perimeter device is involved, the post-patch question is not only whether the hole is closed, but whether the attacker already used it to change the environment or steal access paths.
Risk and Threat Considerations
Authentication bypass on an internet-facing security appliance can expose the entire network edge to direct compromise. The main risk is not just unauthorised login, but the possibility that an attacker can turn a trust anchor into an entry point for administration, persistence, and lateral movement.
Failure mechanism: The attacker skips authentication on a management interface, reaches privileged functions, and uses them to alter controls or execute code.
Impact: The firewall may no longer enforce trustworthy access boundaries, and the organisation can inherit hidden compromise even after the patch is applied.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Authentication bypass defeats the control intent for administrative access on the firewall |
| AC-17 — Remote Access | The flaw affects remote administrative access paths to the firewall management plane | |
| SI-4 — System Monitoring | Exploitation review depends on detecting misuse of the appliance after compromise | |
| Recommendation — Enforce strong administrative authentication and disable exposed management access paths. Restrict and monitor remote administrative access to perimeter devices. Correlate appliance logs and alerts to identify post-breach abuse. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Access control management is central when a firewall login can be bypassed |
| CIS-12 — Network Infrastructure Management | Perimeter firewall compromise directly concerns infrastructure hardening and oversight | |
| Recommendation — Remove unnecessary management exposure and enforce least access on device administration. Inventory, harden, and monitor internet-facing network infrastructure components. | ||
Practitioner Guidance
Why practitioners should care: A firewall authentication bypass is a boundary failure, not a routine application bug, so its blast radius can be much wider than the vulnerable interface itself. Treat exposed management planes as high-priority assets and verify whether they were reachable from any untrusted segment.
What to watch for: If a device of this class appears in KEV, assume active exploitation pressure and review for configuration drift, unexpected admin activity, and any evidence of follow-on access. If the firewall sat in front of privileged or sensitive services, include those systems in the investigation.
Related resources from NHI Mgmt Group
- CVE-2022-3236 (Sophos Firewall Code Injection)
- Why do authentication bypass and privilege escalation become especially dangerous when they can be chained on a firewall?
- What breaks when a firewall management center authentication bypass is exploited?
- CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass)