How do you patch or mitigate CVE-2022-3236 (Sophos Firewall Code Injection)?

CISA’s required action for CVE-2022-3236 is to apply updates per vendor instructions. In practice, find every instance of Sophos Firewall in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What makes CVE-2022-3236 a patching priority?

Because the flaw is code injection in an internet-facing security appliance, the practical question is not just whether a patch exists, but whether the appliance is exposed long enough for exploitation to occur. Treat every deployed instance as potentially reachable from outside and verify whether any management surface or remote access path increases the blast radius if the device is compromised.

For this class of issue, the right first step is inventory, then exposure review, then remediation. If the appliance cannot be updated immediately, the mitigation decision is usually to narrow or remove external reachability rather than assume the device will remain safe while you delay the fix.

How should you confirm exposure and reduce risk before remediation?

Start by locating every Sophos Firewall instance, including test, standby, and forgotten edge deployments. Then determine whether each one is internet-facing, whether remote management is enabled, and whether any dependent services would still function if the device had to be taken out of service. That is the difference between a patch plan and a recovery plan.

Where patching must wait, use the strongest temporary containment available: isolate the device from the public internet, restrict administrative reachability to trusted networks, and monitor for unusual configuration changes or unexpected process activity. For appliance issues like this, delaying action while leaving the box exposed is usually the highest-risk option.

The vendor advisory and the CISA Known Exploited Vulnerabilities Catalog should be your source of truth for the exact remediation path and timing, while the NIST National Vulnerability Database gives you the authoritative record to track the vulnerability and confirm whether your asset inventory lines up with the affected product.

What should you check after applying the fix or mitigation?

Once remediation is complete, review logs for signs that the flaw was used before the update, because active exploitation changes the response from patching to incident handling. Focus on authentication anomalies, unexpected outbound connections, unusual admin activity, and any configuration drift that does not match change records.

If you find evidence of compromise, treat the firewall as a security boundary that may no longer be trustworthy. That can mean rebuilding the appliance, resetting credentials used to administer it, and validating whether any tunnels, VPN sessions, or adjacent systems were accessed through it.

Risk and Threat Considerations

An internet-facing firewall vulnerability is dangerous because the device sits at a trust boundary, so successful injection can turn perimeter control into attacker execution. That is especially serious when the appliance also brokers remote access or administrative traffic, because compromise can create immediate pivot opportunities into the internal network.

Failure mechanism: Code injection on a perimeter appliance can let an attacker execute commands in a high-trust management context, alter rules or settings, and establish persistence before defenders notice the change.

Impact: The result can be traffic interception, unauthorized access, lateral movement, service disruption, or the need to replace the appliance if integrity cannot be confidently restored.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Requires timely remediation of exploited software flaws on security appliances.
	AU-6 — Audit Record Review, Analysis, and Reporting	Supports post-remediation log review for signs of earlier exploitation.
Recommendation — Prioritise flaw remediation for the firewall and verify the update is installed. Review firewall logs for indicators of exploitation after remediation.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Applies because the question is about patching an actively exploited vulnerability.
	CIS-12 — Network Infrastructure Management	Applies to hardening and isolating an internet-facing firewall appliance.
Recommendation — Track the firewall as a high-priority vulnerability until remediation is complete. Restrict external reachability and segment administrative access while remediating.
OWASP ASVS	V16 — Security Logging and Error Handling	Relevant because validation of logs is part of confirming whether exploitation occurred.
Recommendation — Validate logging coverage so you can investigate post-exploitation indicators.

Practitioner Guidance

What to prioritise: Patch exposed firewalls first, then move to less exposed instances. If an appliance is internet-facing and cannot be updated promptly, treat removal from service or strict isolation as the safer interim state.

What to verify: Confirm that the device was updated under the vendor’s instructions and that the mitigation actually removed the risky exposure path. A change ticket alone is not enough; you need evidence that the running configuration now matches the intended state.

Practitioner takeaway: For a vulnerable firewall, the main decision is not patch-versus-monitor, it is whether you can still trust the boundary while you wait. If you cannot, containment comes before convenience.