We are talking about the CVE-2022-3236 issue (9.8 points on the CVSS vulnerability rating scale), which was found in the User Portal and the Sophos Firewall web admin. In fact, this bug allows attackers to achieve arbitrary code execution (RCE).
Hotfixes for all versions of Sophos Firewall affected by this bug (v19.0 MR1, 19.0.1 and older) were released back in September last year, and full patches were submitted in December. At the same time, back in the fall, the manufacturer warned that [...]