Is CVE-2022-1040 (Sophos Firewall Authentication Bypass) being exploited in the wild?

Yes. CISA added CVE-2022-1040 to its Known Exploited Vulnerabilities catalogue on 31 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What CVE-2022-1040 Tells You About Exposure

This is not a theoretical issue once a firewall appliance is publicly reachable. The key question is whether the product is deployed, exposed, and still within the vulnerable configuration state described by the vendor and the CISA KEV listing. For internet-facing edge devices, that includes management-plane exposure, remote administration paths, and any delayed patching or compensating control gap.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to confirm whether your exact deployment remains affected and whether the required remediation has been applied.

For edge appliances, exposure is often broader than a single host record suggests. The same device may front multiple networks, terminate remote access, and hold administrative trust, so one bypass can create a path to deeper compromise if the management surface is reachable from untrusted networks.

What the Attack Path Means Operationally

An authentication bypass on a perimeter firewall is operationally serious because it can remove the gate that protects the administrative plane. When that control fails, an attacker may be able to reach functions intended only for trusted administrators, which can turn a login flaw into code execution, configuration tampering, or follow-on access into connected environments.

That is why the product category matters as much as the CVE itself. A firewall is not just another server, it is a trust boundary device, so compromise can affect VPN access, internal segmentation, policy enforcement, and the credibility of logs generated after the event.

For teams running internet-facing appliances, Edge Device Security Guide is the right internal reference for the broader hardening and logging expectations that apply to exposed network devices like firewalls, routers, gateways, and load balancers.

How to Respond When a Firewall Bypass Is Being Exploited

Do not treat this as a routine patch item. If the appliance is in scope, prioritise confirming exposure, applying the vendor fix or mitigation, and then checking whether the device was already touched before remediation. With KEV-listed flaws, the practical issue is often not whether exploitation is possible, but whether compromise has already occurred while the device was reachable.

If patching must wait, the fallback is to reduce reachability and remove unnecessary administrative exposure rather than rely on the appliance remaining trustworthy. That usually means restricting management access, reviewing remote access paths, and preserving logs and configuration state before making changes that could erase evidence.

Where the same appliance also handles authentication, session termination, or remote administration, credential and session review should follow quickly after remediation. A bypass in that position can expose administrative credentials, session tokens, or downstream access paths even if the initial issue looks narrow.

Risk and Threat Considerations

Firewall bypass flaws are attractive because they attack a trust boundary, not just a single application. If an adversary can cross the administrative boundary, they may be able to alter rules, create persistence, disable inspection, or use the device as a pivot point into adjacent systems.

Failure mechanism: Authentication controls on an internet-facing management surface fail, allowing unauthorised access to functions that should have been restricted to trusted administrators, which can then be chained into configuration changes or remote execution.

Impact: The resulting compromise can expose internal networks, undermine segmentation, and force emergency containment across every service that depended on the firewall as a control point.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Exploit-priority triage and urgent remediation for a KEV-listed flaw align directly.
Recommendation — Prioritise and remediate the exposed firewall vulnerability immediately under continuous vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about an actively exploited vulnerability and urgent remediation actions.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exploitation checking depends on reviewing logs for access during the exposure window.
Recommendation — Apply flaw remediation controls to confirm exposure and accelerate vendor fix deployment. Review firewall and authentication logs for indicators of access during the vulnerable period.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is a vulnerability management and remediation decision for an exposed security appliance.
Recommendation — Manage the flaw as a high-priority technical vulnerability and document remediation status.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The vulnerability is on an exposed appliance and enables remote compromise via the public-facing surface.
Recommendation — Hunt for exploitation against the exposed management interface as a public-facing attack path.

Practitioner Guidance

What to verify: Confirm the exact appliance model, deployed version, management exposure, and whether the device is listed in your emergency remediation queue. Then verify whether logs, backups, and configuration exports are preserved before any disruptive action.

Check whether the webadmin or user portal is reachable from untrusted networks.
Validate that remediation actually removed the vulnerable condition, not just the alert.
Review authentication, admin, and VPN logs for access during the exposure window.

Decision rule: If the firewall was internet reachable while vulnerable, treat it as a potential compromise investigation, not only a patch task. If evidence is incomplete, contain first and investigate before assuming the device is clean.

Practitioner takeaway: For KEV-listed firewall flaws, the operational priority is to prove whether the device was exposed long enough to be abused, then rotate any credentials or sessions that may have passed through that trust boundary.