Is CVE-2022-3236 (Sophos Firewall Code Injection) being exploited in the wild?

Yes. CISA added CVE-2022-3236 to its Known Exploited Vulnerabilities catalogue on 23 September 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What makes Sophos Firewall code injection urgent when it is already in CISA KEV?

CVE-2022-3236 is not a theoretical exposure. If an organisation still runs the affected Sophos Firewall product, the practical question is whether the User Portal or Webadmin is reachable, whether the device is internet-facing, and whether the appliance has been treated as a high-priority remediation target since CISA listed it as actively exploited. The issue matters because code injection on a security gateway can become immediate remote code execution.

For edge appliances, the first-order concern is blast radius. A firewall is both a control point and a trust anchor, so successful exploitation can move the incident from perimeter exposure to direct device compromise. NHIMG’s Edge Device Security Guide is relevant here because exposed management interfaces, patch latency, logging, and end-of-life handling are the exact operational weak points that make appliance exploits dangerous.

This is why KEV inclusion should change prioritisation immediately. A vulnerability may be technically serious in abstract, but once it is known to be exploited in the wild, the decision shifts from routine patch planning to emergency exposure reduction and verification that the firewall is actually fixed, not just scheduled for maintenance.

How should you confirm exposure and scope?

Start with asset and interface confirmation, not with assumptions about vendor deployment. Verify which Sophos Firewall instances exist, which ones expose the User Portal or Webadmin, and whether any administrative path is reachable from untrusted networks. If you cannot confidently answer those questions, you do not yet know your attack surface.

Then confirm whether the device is already inside a hardened access pattern. A firewall admin interface should not be broadly reachable just because the organisation considers it “internal.” If remote management is necessary, it should be tightly constrained and monitored. For broad vulnerability triage and exposed CVE handling, NHIMG’s Vulnerability Management Guide is the better organising reference than ad hoc patch queues, because it ties scope, prioritisation, exception handling, and verification together.

Where a product is both security-critical and internet-facing, version inventory alone is not enough. You need proof of remediation, evidence that the vulnerable service is no longer exposed, and a follow-up check for signs that the device was used as an initial foothold before the fix was applied.

What should happen if patching or mitigation must wait?

If immediate remediation is impossible, treat mitigation as a temporary containment measure, not a substitute for fix deployment. Reduce exposure by restricting management access to trusted administration paths, removing unnecessary internet reachability, and increasing monitoring of the appliance and adjacent authentication paths. The goal is to make exploitation materially harder while you work the permanent change.

Because the issue is already known to be exploited, delay increases risk every day the management surface remains available. CISA’s Known Exploited Vulnerabilities Catalog exists for precisely this prioritisation problem: once a CVE is listed there, it should be handled as an active exposure with a strong operational deadline, not as a generic backlog item.

For exploit-prioritisation context, the pattern is consistent with other actively exploited edge-device weaknesses. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is useful because it frames the right sequence: emergency mitigation first, then patching, then post-fix hunting and validation.

Risk and Threat Considerations

Compromise of a firewall management interface is especially high impact because the attacker is targeting a device that sits at a trust boundary and often has visibility into broad network activity. The practical risk is not only remote code execution, but also configuration tampering, traffic redirection, credential theft, and use of the appliance as a staging point for deeper intrusion.

Failure mechanism: Code injection in an exposed administrative interface can let an attacker execute commands with device-level authority, then alter security controls, harvest data, or establish persistence before defenders notice.

Impact: The result can be perimeter compromise, loss of control over filtering or VPN services, lateral movement opportunities, and a need for incident response that goes beyond simple patching.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Known exploited CVEs require risk-based prioritization and emergency remediation decisions.
Recommendation — Prioritise KEV-listed exposure for emergency remediation and tracked risk acceptance.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue demands urgent remediation of a known exploitable vulnerability.
	AU-6 — Audit Review, Analysis, and Reporting	Compromise assessment depends on reviewing logs for abnormal admin activity and tampering.
Recommendation — Remediate the vulnerable firewall promptly and verify the fix is fully applied. Review appliance and admin logs for exploitation indicators and unauthorized changes.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV status makes continuous vulnerability prioritization and remediation central to this case.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	Management interface exposure and hardened admin access are key to reducing attack surface.
Recommendation — Use KEV status to drive urgent remediation and confirm exposure has been removed. Restrict firewall management exposure and harden administrative access paths.

Practitioner Guidance

What to verify: Confirm whether any Sophos Firewall instance exposed the affected management surface during the exposure window, and verify from logs or device state whether there are indicators of tampering, unusual admin activity, or unexpected configuration changes.

Decision rule: If the firewall is externally reachable or cannot be confidently ruled out as exposed, prioritise containment and emergency remediation ahead of ordinary change scheduling. If compromise cannot be excluded, treat the device as a potential incident scene and preserve relevant logs before disruptive rebuilding.

Practitioner takeaway: For KEV-listed firewall flaws, the right question is not whether the vulnerability is patched eventually, but whether the management surface was exposed long enough for exploitation to matter operationally.