Security software and hardware vendor Sophos has patched a critical zero-day firewall vulnerability that is being actively exploited in-the-wild, targeting a specific set of organizations in the South Asia region. The flaw, tracked as CVE-2022-3236 (with a CVSS score of 9.8/10), is a code injection vulnerability discovered in the User Portal and Web administration components of the Sophos Firewall product. If exploited, this flaw could allow malicious attackers to conduct arbitrary remote code execution (RCE). The specific technical details surrounding the attacks have not yet been published due to Sophos’ ongoing post-compromise investigation, and it’s highly likely that a proof-of-concept (PoC) exploit will be published in the coming weeks. This isn’t the first Sophos firewall vulnerability this year; in March, another zero-day Sophos Firewall flaw tracked as CVE-2022-1040 (also with a CVSS score of 9.8/10) was actively exploited in a “highly-targeted” attack campaign. Threat actors were able to exploit CVE-2022-1040, an authentication bypass vulnerability, to perform RCE, allowing them to conduct a man-in-the-middle (MITM) attack to pilfer sensitive network data. Post-compromise analysis of the March attack attributed the activity to a Chinese state-sponsored threat actor known as “DriftingCloud,” and coincidently, the threat group was also targeting a specific unnamed South Asian victim. This suggests that the two (2) campaigns may be associated with the same actor and/or same campaign, however that cannot be said with high confidence until the details of this latest vulnerability become public so that the tactics, techniques, and procedures (TTPs) of the two (2) attacks can be compared. This vulnerability has been patched by Sophos, and customers utilizing the company’s firewall products should ensure that they are running the most up-to-date version of the software to prevent exploitation. In the event that the firewalls can’t be updated immediately, Sophos has provided manual mitigation techniques, urging their customers to “Disable WAN access to the User Portal and Webadmin by following device access best practices and instead use VPN and/or Sophos Central (preferred) for remote access and management.” CTIX analysts will continue to monitor this vulnerability, and an update may be released in future issues.