Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2020-9363: The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive

43
This month
HIGH 7.8UPGRADEUPGRADEUPGRADE

CVE-2020-9363 is a high-severity flaw (CVSS 7.8) affecting cloud optix, endpoint protection, intercept x endpoint. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction.

Why this priority

  • High severity

A fixed release or distro patch exists.

Risk facts

CVSS score7.8 (High)
Attack vectorLocal
Attack complexityLow
Privileges neededNone
User interactionRequired
EPSS exploit chance1.0% (top 38%)
CISA exploited listNo
WeaknessCWE-436
Published2020-02-24
Last modified2026-06-17
Publisher (CNA): MITRE · Vendor: sophos

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

sophos cloud optix UPGRADE
Affected: < 2020-01-14
Fixed in: 2020-01-14
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy cloud-optix || rpm -q cloud-optix || cloud-optix --version
2. UPGRADE to 2020-01-14 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade cloud-optix
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade cloud-optix
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
sophos endpoint protection UPGRADE
Affected: < 2020-01-14
Fixed in: 2020-01-14
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy endpoint-protection || rpm -q endpoint-protection || endpoint-protection --version
2. UPGRADE to 2020-01-14 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade endpoint-protection
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade endpoint-protection
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
sophos intercept x endpoint UPGRADE
Affected: < 2020-01-14
Fixed in: 2020-01-14
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy intercept-x-endpoint || rpm -q intercept-x-endpoint || intercept-x-endpoint --version
2. UPGRADE to 2020-01-14 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade intercept-x-endpoint
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade intercept-x-endpoint
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
sophos intercept x for server UPGRADE
Affected: < 2020-01-14
Fixed in: 2020-01-14
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy intercept-x-for-server || rpm -q intercept-x-for-server || intercept-x-for-server --version
2. UPGRADE to 2020-01-14 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade intercept-x-for-server
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade intercept-x-for-server
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
sophos mobile UPGRADE
Affected: < 2020-01-14
Fixed in: 2020-01-14
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy mobile || rpm -q mobile || mobile --version
2. UPGRADE to 2020-01-14 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade mobile
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade mobile
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
sophos secure web gateway UPGRADE
Affected: < 2020-01-14
Fixed in: 2020-01-14
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy secure-web-gateway || rpm -q secure-web-gateway || secure-web-gateway --version
2. UPGRADE to 2020-01-14 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade secure-web-gateway
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade secure-web-gateway
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-9363?

cloud optix: upgrade to 2020-01-14; endpoint protection: upgrade to 2020-01-14; intercept x endpoint: upgrade to 2020-01-14. Exact commands for each OS are on this page.

Is CVE-2020-9363 being exploited?

CVE-2020-9363 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-9363 affect?

CVE-2020-9363 affects cloud optix, endpoint protection, intercept x endpoint. Severity is high (CVSS 7.8). The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the v

How urgent is CVE-2020-9363?

Priority 43/100. High severity

Software pages

Sophos vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.