A critical vulnerability in the Sophos Firewall has been patched, correcting a flaw that if exploited would allow attackers to perform arbitrary remote code execution (RCE). Sophos is a next generation cloud-based cybersecurity infrastructure that provides a single cloud management system for managing cyber threats via AI and machine learning threat-intelligence tools. The vulnerability, tracked as CVE-2022-1040, was identified by an unnamed security researcher through Sophos’ bug bounty program and is described as an authentication bypass bug impacting the User Portal and Webadmin consoles of Sophos Firewall. Sophos has observed this vulnerability being exploited in-the-wild to specifically target and victimize organizations in South Asia. Sophos Firewall versions 18.5 MR3 (18.5.3) and earlier are affected by this vulnerability, but a hotfix has been released. If a Sophos Firewall instance has automatic updates enabled (which is a default feature), then administrators and cybersecurity professionals need not take any further action. If the instance is an end-of-life version, then it will need to be manually configured by disabling WAN exposure to the User Portal and Webadmin console. This is not the first time that vulnerabilities in the Sophos infrastructure have been exploited by threat actors, and the Ankura CTIX urges all administrators and operators to ensure that the “allow automatic installation of hotfixes” setting is enabled as well as verify that their Sophos instances are all the most recent stable versions.