Is CVE-2020-25223 (Sophos SG UTM Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2020-25223 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for this CVE

For a KEV-listed vulnerability like CVE-2020-25223, the practical question is not whether exploitation is theoretically possible, but whether the affected product is exposed and reachable in a way that lets an attacker reach the vulnerable WebAdmin path. That makes asset inventory, exposure review, and rapid remediation the first decision points.

Because this is remote code execution, a successful exploit can move from a browser-facing management weakness to full system impact quickly. In other words, the security question is really about whether the appliance is still present, still internet reachable, and still running with an exposure pattern that attackers can use.

Why KEV status changes the response

CISA KEV inclusion should be treated as a strong operational signal that the issue is already attractive to real attackers, not just a lab proof of concept. That means the response posture should shift from routine patch scheduling to urgent prioritisation, with remediation ranked ahead of lower-value maintenance work.

If you need a broader triage model for active exploitation, Zero-Day and Exploited Vulnerabilities Guide is a useful companion because it frames how to handle vulnerabilities once exploitation is confirmed or strongly suspected. For edge and gateway-style appliances specifically, the Edge Device Security Guide is relevant because management-plane exposure is often the failure condition that turns a product flaw into an incident.

What to do if you cannot patch immediately

If remediation must wait, the first goal is to reduce attack surface around the WebAdmin interface rather than assuming the product is safe because no alert has fired. Restrict access to management paths, place them behind trusted administration networks, and verify whether the appliance is externally reachable from any path that a scanner or opportunistic attacker could find.

Use the vendor advisory for exact remediation steps and the CISA Known Exploited Vulnerabilities Catalog for authoritative prioritisation context. If the organisation tracks vulnerable assets centrally, the Vulnerability Management Guide is helpful because it ties exposure review, exception handling, and verification into one workflow.

Risk and Threat Considerations

This vulnerability matters because remote code execution on an internet-facing administrative surface can become full appliance compromise very quickly. The risk is highest where the device is exposed to the public internet, left unmanaged, or treated as a low-visibility network box instead of a high-value security control.

Failure mechanism: An attacker reaches the vulnerable WebAdmin interface, triggers code execution, and uses the appliance as a foothold for control, reconnaissance, or follow-on access.

Impact: Compromise can expose traffic, credentials, management access, and adjacent systems, while also creating a durable persistence point if the appliance remains trusted by the environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV exploitation requires risk-based urgency and prioritization.
Recommendation — Prioritise exposed KEV items ahead of routine remediation work.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue requires urgent remediation of a known exploitable flaw.
	AC-4 — Information Flow Enforcement	Restricting management-plane reachability reduces exploit paths.
Recommendation — Remediate the vulnerable appliance promptly and verify the fix. Limit access to WebAdmin to trusted administrative paths only.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation is a vulnerability management prioritization problem.
Recommendation — Track, prioritize, and remediate exploited vulnerabilities first.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	Known exploited flaws demand controlled vulnerability remediation.
Recommendation — Manage the flaw through documented vulnerability handling and verification.

Practitioner Guidance

What to verify: Confirm whether any Sophos SG UTM instance is still deployed, whether WebAdmin is reachable from untrusted networks, and whether compensating controls actually reduce reachability rather than simply logging access attempts.

Decision rule: If the device is internet reachable, treat it as urgent until fixed; if it is no longer supported or cannot be remediated quickly, accelerate retirement or isolation rather than relying on exception handling.

Practitioner takeaway: For KEV-listed remote code execution issues, the most important judgement is whether the vulnerable management surface is still exposed, because exposure, not just versioning, determines how quickly the issue can become an incident.