CVE-2026-3982: Sophos Firewall Active Exploitation — Detection and Hardening Guide

---
title: Sophos Firewall CVE-2026-3982 Exploitation Attempt
id: 9d8e7c6a-5b43-4f12-a11c-9e8d7f6a5b12
status: experimental
description: Detects potential exploitation of CVE-2026-3982 against Sophos Firewall User Portal/Webadmin based on known SQLi patterns in URI parameters.
references:
  - https://isc.sans.edu/diary/rss/32946
author: Security Arsenal
date: 2026/05/04
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.3982
logsource:
  category: webserver
  product: sophos
detection:
  selection:
    c-uri|contains:
      - 'webconsole'
      - 'userportal'
    cs-method: POST
    c-uri-query|contains:
      - 'UNION SELECT'
      - 'concat(0x'
      - 'DROP TABLE'
      - ';exec('
  condition: selection
falsepositives:
  - Penetration testing activity
level: critical
---
title: Sophos Firewall Suspicious Root Process Spawn
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects suspicious process execution on the underlying Linux OS of the firewall following exploitation (e.g., curl, wget, or bash spawned by the web service account).
references:
  - https://isc.sans.edu/diary/rss/32946
author: Security Arsenal
date: 2026/05/04
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/httpd'
      - '/nginx'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
      - '/usr/bin/python'
    User|contains:
      - 'nobody'
      - 'www-data'
  condition: selection
falsepositives:
  - Legitimate administrative debugging
level: high

// Hunt for suspicious SQLi patterns in Sophos Firewall Proxy Logs
// Adjust table names based on your specific ingestion format (e.g., CommonSecurityLog, SophosFirewall)
SophosFirewall
| where TimeGenerated > ago(7d)
| where ActionType contains "web"
| where DestinationPort in (443, 8080)
| where RequestURL has "webconsole" or RequestURL has "userportal"
| where RequestMethod == "POST"
| extend QueryParams = extract_all(@"(\?[^\s]+)", RequestURL)[0]
| where isnotempty(QueryParams)
| where QueryParams has_any ("UNION", "SELECT", "DROP", "exec", "0x", "script")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, QueryParams
| summarize count() by SourceIP, RequestURL
| order by count_ desc

-- Hunt for evidence of webshell or payload creation on Linux-based appliances
-- This requires Velociraptor deployed on the endpoint (rare for firewalls, but possible for hosted/VM instances)
SELECT FullPath, Size, ModTime, Mode
FROM glob(globs="/tmp/*", root="/")
WHERE ModTime > now() - 24h
  AND (Name =~ "sh\." OR Name =~ "\.py" OR Name =~ "\.php")
  AND Mode != "0644" -- Look for executable permissions on temp files

-- Hunt for active network connections to non-standard C2 ports established by root/web user
SELECT Fd, Family, Type, RemoteAddr, State, Pid, Username, StartTime
FROM netstat()
WHERE RemoteAddr != "0.0.0.0" AND RemoteAddr != "::"
  AND RemotePort > 1024
  AND Username IN ("root", "nobody", "www-data")
  AND StartTime > now() - 1h

#!/bin/bash
# Temporary Mitigation for CVE-2026-3982
# Disables WAN access to User Portal and Webadmin if not explicitly allowed.
# WARNING: Run this only in the Sophos Firewall CLI shell or via SSH.
# Ensure you have a backup configuration before running.

LOG_FILE="/var/log/cve_2026_3982_mitigation.log"
echo "Starting mitigation for CVE-2026-3982 at $(date)" >> $LOG_FILE

# Check if running as root (expected on firewall)
if [ "$EUID" -ne 0 ]; then
  echo "Please run as root." >> $LOG_FILE
  exit 1
fi

# Block external access to User Portal on port 443
# Replace 'eth1' with your actual WAN interface name
iptables -I INPUT 1 -i eth1 -p tcp --dport 443 -j DROP
if [ $? -eq 0 ]; then
    echo "Rule added: Blocked external TCP 443 on WAN interface." >> $LOG_FILE
else
    echo "Failed to add rule for TCP 443." >> $LOG_FILE
fi

# Block external access to Webadmin on port 8080
iptables -I INPUT 2 -i eth1 -p tcp --dport 8080 -j DROP
if [ $? -eq 0 ]; then
    echo "Rule added: Blocked external TCP 8080 on WAN interface." >> $LOG_FILE
else
    echo "Failed to add rule for TCP 8080." >> $LOG_FILE
fi

echo "Mitigation complete. Verify rules with: iptables -L -n -v" >> $LOG_FILE