PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-1671 Sophos CVE debrief

CVE-2023-1671 is a Sophos Web Appliance command injection vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2023-11-16. Because it is listed in KEV, defenders should treat it as an active-risk issue and follow the vendor's mitigation guidance immediately, or discontinue use of the product if mitigations are not available.

Vendor
Sophos
Product
Web Appliance
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2023-11-16
Original CVE updated
2026-09-27
Advisory published
2026-09-27
Advisory updated
2026-09-27

Who should care

Organizations that operate Sophos Web Appliance, especially security and infrastructure teams responsible for internet-facing appliances, vulnerability management, and incident response.

Technical summary

CISA's KEV entry identifies CVE-2023-1671 as a command injection vulnerability in Sophos Web Appliance and marks it as known exploited. The catalog entry directs affected users to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Defensive priority

High. CISA added this CVE to the Known Exploited Vulnerabilities catalog and set a remediation due date of 2023-12-07, indicating urgent defensive attention.

Recommended defensive actions

  • Confirm whether Sophos Web Appliance is deployed anywhere in the environment.
  • Review the Sophos security advisory referenced by CISA and apply the vendor's mitigation instructions as soon as possible.
  • If mitigations are unavailable or cannot be applied in a timely way, discontinue use of the product.
  • Prioritize remediation before the CISA KEV due date and track completion in vulnerability management.
  • Validate exposure in all internet-facing and high-value segments, then document the remediation status.

Evidence notes

Supported facts are limited to the CISA KEV source item and the linked official references. The source identifies Sophos as the vendor, Web Appliance as the product, the issue as a command injection vulnerability, the KEV dateAdded as 2023-11-16, the dueDate as 2023-12-07, and the required action as applying vendor mitigations or discontinuing use if mitigations are unavailable. No additional exploitation details or affected-version information are included in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-1671 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-1671

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-1671 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-1671

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.