Version 18.25.54
Released on September 10, 2026
Introduction
The Release Note document for IPS, NDR Active threat intelligence and Application signature Database version
18.25.54 includes support for both, the new and the updated Signatures. The following sections
describe the release in detail.
Release Information
Upgrade Applicable on: Version
18.25.53
Fixed issues, listed by ID, description, explanation and Workaround.
| Appliance Model |
Details of Changes |
Module |
More Details |
| All Deployments |
0 Application |
0 Application Signature |
0 Application category |
Application Filter |
Click Here for details of changes |
| XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136,
XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500,
XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w),
XG-210, XG-230, XG-310, XG-330, XG-430, XG-450,
SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230,
SG-310, SG-330, SG-430, SG-450, SG-550, SG-650
Any virtual deployment with RAM < 24GB
|
49 Signatures |
46 Vulnerabilities |
5 IPS Categories |
IPS Filter |
Click Here for details of changes |
| XG-550, XG-650, XG-750
XGS-5500, XGS-6500
Any virtual deployment with RAM >24GB
|
67 Signatures |
62 Vulnerabilities |
5 IPS Categories |
IPS Filter |
Click Here for details of changes |
| XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136,
XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500,
XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w),
XG-210, XG-230, XG-310, XG-330, XG-430, XG-450,
SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230,
SG-310, SG-330, SG-430, SG-450, SG-550, SG-650
Any virtual deployment with RAM < 24GB
|
0 Signature |
0 Vulnerability |
0 NDR Category |
NDR Ati Filter |
Click Here for details of changes |
| XG-550, XG-650, XG-750
XGS-5500, XGS-6500
Any virtual deployment with RAM >24GB
|
0 Signature |
0 Vulnerability |
0 NDR Category |
NDR Ati Filter |
Click Here for details of changes |
Report false positives at support@sophos.com along with the application details.
Upgrade Information
Upgrade type: Automatic
Compatibility Annotations: None
The Sophos Application Filter controls the application traffic depending on the policy configured, by
matching them with the Application Signatures. Application Signatures optimize the detection
performance and reduces the false alarms.
The table below provides details of signature included in this release.
This Application Filter Release include Zero (0) Application Signature
is updated for Zero (0) Application.
Fixed issues, listed by ID, description, explanation and Workaround.
| Application Name |
Risk |
Category |
Application Name: Name of the Application that can be
identified by Sophos Application Filter.
Risk: Describes the level of risk for the application. The
levels of risks are described in the table below.
Fixed issues, listed by ID, description, explanation and Workaround.
| Risk Level |
Risk Criteria |
| 1 |
Very Low |
| 2 |
Low |
| 3 |
Medium |
| 4 |
High |
| 5 |
Very High |
Category: Identifies the category of the Application.
Note: These Application Filtering signatures support prior
versions of respective application.
The Sophos Intrusion Prevention System shields the network from known attacks by matching the
network traffic against the signatures in the IPS Signature Database. These signatures are
developed to significantly increase detection performance and reduce the false alarms.
Applicable to: XGS-87, XGS-87(w), XGS-107, XGS-107(w),
XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100,
XGS-3300, XGS-4300, XGS-4500, XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125,
XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450, SG-105,
SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310,
SG-330, SG-430, SG-450, SG-550, SG-650 Any virtual deployment with RAM < 24GB
The table below provides details of Signatures included in this release.
This IPS Release includes Forty nine(49) Signatures
to address
Forty six(46) Vulnerabilities.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
| BROWSER-IE Microsoft Internet Explorer Invalid Flag Reference Memory Corruption |
CVE-2010-3962 |
browser-ie |
1 |
| MALWARE-CNC Cyclops Blink Malware Communication Detected |
|
malware-cnc |
1 |
| OS-WINDOWS Microsoft Install Service elevation of privilege attempt |
CVE-2026-69605 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt |
CVE-2026-70342 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt |
CVE-2026-80093 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Core Messaging elevation of privilege attempt |
CVE-2026-70583 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Device Association Service elevation of privilege attempt |
CVE-2026-69478 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Device Association Service elevation of privilege attempt |
CVE-2026-69714 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Device Association Service elevation of privilege attempt |
CVE-2026-77500 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows File History Service elevation of privilege attempt |
CVE-2026-71340 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-68846 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-68884 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-69366 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-69466 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-69473 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Local Security Authority Server elevation of privilege attempt |
CVE-2026-69277 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt |
CVE-2026-69451 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows NFS ONCRPC XDR driver remote code execution attempt |
CVE-2026-70585 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt |
CVE-2026-69364 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt |
CVE-2026-69921 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Program Compatibility Assistant Service elevation of privilege attempt |
CVE-2026-68876 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Program Compatibility Assistant Service elevation of privilege attempt |
CVE-2026-69530 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Registry elevation of privilege attempt |
CVE-2026-69337 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Remote Access Connection Manager remote code execution attempt |
CVE-2026-71343 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69305 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69585 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69600 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69911 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows TCP/IP driver elevation of privilege attempt |
CVE-2026-69757 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows TCP/IP elevation of privilege attempt |
CVE-2026-69385 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Virtual Hard Disk Miniport Driver elevation of privilege attempt |
CVE-2026-69541 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-69301 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-69498 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-69779 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-70289 |
os-windows |
1 |
| SERVER-ORACLE Oracle WebLogic Server CVE-2018-2894 Web Service Config Arbitrary File Upload |
CVE-2018-2894 |
server-oracle |
3 |
| SERVER-WEBAPP Avada Fusion Builder CVE-2026-8713 Unauthenticated Arbitrary File Deletion Vulnerability |
CVE-2026-8713 |
server-webapp |
1 |
| SERVER-WEBAPP Crawl4AI CVE-2026-53753 Unauth Remote Code Execution Vulnerability |
CVE-2026-53753 |
server-webapp |
1 |
| SERVER-WEBAPP Dalfox REST API CVE-2026-45087 Remote Code Execution Vulnerability |
CVE-2026-45087 |
server-webapp |
1 |
| SERVER-WEBAPP Flowise CSV Agent CVE-2026-41264 Prompt Injection RCE Vulnerability |
CVE-2026-41264 |
server-webapp |
1 |
| SERVER-WEBAPP Gladinet Triofox Server Agent WOSDefaultHttpModule.dll CVE-2026-8362 Stack-Based Buffer Overflow Vulnerability |
CVE-2026-8362 |
server-webapp |
1 |
| SERVER-WEBAPP Microsoft SharePoint Server Document ID Service GetProvider Unsafe Reflection |
CVE-2026-63514 |
server-webapp |
2 |
| SERVER-WEBAPP Node.js CVE-2026-47208 Remote Code Execution Vulnerability |
CVE-2026-47208 |
server-webapp |
1 |
| SERVER-WEBAPP Orkes Conductor CVE-2026-58138 Unauthenticated RCE Vulnerability |
CVE-2026-58138 |
server-webapp |
1 |
| SERVER-WEBAPP Progress Kemp LoadMaster command injection attempt |
CVE-2026-8037 |
server-webapp |
1 |
| SERVER-WEBAPP Qwik CVE-2026-27971 Unsafe Deserialization Vulnerability |
CVE-2026-27971 |
server-webapp |
1 |
The Sophos Intrusion Prevention System shields the network from known attacks by matching
the network traffic against the signatures in the IPS Signature Database. These
signatures are developed to significantly increase detection performance and reduce the
false alarms.
Applicable to: XGS-5500, XGS-6500, XGS-7500,
XGS-8500, XG-550, XG-650, XG-750 and Any virtual deployment with RAM > 24GB
The table below provides details of Signatures included in this release.
This IPS Release includes Sixty seven(67) Signatures
to address
Sixty two(62) Vulnerabilities.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
| MALWARE-CNC Cyclops Blink Malware Communication Detected |
|
malware-cnc |
1 |
| MALWARE-CNC Malware Backdoor.PHP.Truconphashell.A Runtime Detection - (Shell or SQL command) |
|
malware-cnc |
1 |
| OS-WINDOWS Microsoft Install Service elevation of privilege attempt |
CVE-2026-69605 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Ancillary Function Driver for WinSock elevation of privilege attempt |
CVE-2026-70342 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt |
CVE-2026-80093 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Core Messaging elevation of privilege attempt |
CVE-2026-70583 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Device Association Service elevation of privilege attempt |
CVE-2026-69478 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Device Association Service elevation of privilege attempt |
CVE-2026-69714 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Device Association Service elevation of privilege attempt |
CVE-2026-77500 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows File History Service elevation of privilege attempt |
CVE-2026-71340 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-68846 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-68884 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-69366 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-69466 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt |
CVE-2026-69473 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel information disclosure attempt |
CVE-2026-69406 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Kernel information disclosure attempt |
CVE-2026-69723 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Local Security Authority Server elevation of privilege attempt |
CVE-2026-69277 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt |
CVE-2026-69451 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows NFS ONCRPC XDR driver remote code execution attempt |
CVE-2026-70585 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt |
CVE-2026-69364 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Print Spooler Components elevation of privilege attempt |
CVE-2026-69921 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Program Compatibility Assistant Service elevation of privilege attempt |
CVE-2026-68876 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Program Compatibility Assistant Service elevation of privilege attempt |
CVE-2026-69530 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Registry elevation of privilege attempt |
CVE-2026-69337 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Remote Access Connection Manager remote code execution attempt |
CVE-2026-71343 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69305 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69585 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69600 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Search Component elevation of privilege attempt |
CVE-2026-69911 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows TCP/IP driver elevation of privilege attempt |
CVE-2026-69757 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows TCP/IP elevation of privilege attempt |
CVE-2026-69385 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Virtual Hard Disk Miniport Driver elevation of privilege attempt |
CVE-2026-69541 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-69301 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-69498 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-69779 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt |
CVE-2026-70289 |
os-windows |
1 |
| OS-WINDOWS Microsoft Windows Win32k information disclosure attempt |
CVE-2026-69832 |
os-windows |
1 |
| SERVER-APACHE Apache Tomcat Tribes cluster insecure deserialization attempt |
CVE-2026-34486 |
server-apache |
2 |
| SERVER-OTHER Cisco IOS EVPN NLRI parsing denial of service attempt |
CVE-2026-20276 |
server-other |
3 |
| SERVER-OTHER Cisco Nexus Series Switches code execution attempt |
CVE-2026-20212 |
server-other |
1 |
| SERVER-OTHER Delta Electronics InfraSuite Device Master information disclosure attempt |
CVE-2022-41657 |
server-other |
1 |
| SERVER-OTHER Ivanti Avalance WLInfoRailService denial of service attempt |
CVE-2024-36136 |
server-other |
2 |
| SERVER-OTHER VMware vCenter Server Syslog Directory Traversal (Decrypted Traffic) |
CVE-2026-59310 |
server-other |
1 |
| SERVER-OTHER VMware vCenter Server Syslog Directory Traversal |
CVE-2026-59310 |
server-other |
1 |
| SERVER-WEBAPP Avada Fusion Builder CVE-2026-8713 Unauthenticated Arbitrary File Deletion Vulnerability |
CVE-2026-8713 |
server-webapp |
1 |
| SERVER-WEBAPP Cisco IOS XR gRPC command injection attempt |
CVE-2026-20280 |
server-webapp |
2 |
| SERVER-WEBAPP Cisco Secure FMC Software Hard-coded Credentials |
CVE-2026-20316 |
server-webapp |
3 |
| SERVER-WEBAPP Crawl4AI CVE-2026-53753 Unauth Remote Code Execution Vulnerability |
CVE-2026-53753 |
server-webapp |
1 |
| SERVER-WEBAPP Dalfox REST API CVE-2026-45087 Remote Code Execution Vulnerability |
CVE-2026-45087 |
server-webapp |
1 |
| SERVER-WEBAPP Divi Form Builder Plugin for WordPress CVE-2026-5524 Arbitrary File Upload Vulnerability |
CVE-2026-5524 |
server-webapp |
1 |
| SERVER-WEBAPP Flowise CSV Agent CVE-2026-41264 Prompt Injection RCE Vulnerability |
CVE-2026-41264 |
server-webapp |
1 |
| SERVER-WEBAPP Gitea diffpatch remote code execution attempt |
CVE-2026-60004 |
server-webapp |
1 |
| SERVER-WEBAPP Gladinet Triofox Server Agent WOSDefaultHttpModule.dll CVE-2026-8362 Stack-Based Buffer Overflow Vulnerability |
CVE-2026-8362 |
server-webapp |
1 |
| SERVER-WEBAPP Microsoft SharePoint Server Document ID Service GetProvider Unsafe Reflection |
CVE-2026-63514 |
server-webapp |
2 |
| SERVER-WEBAPP Node.js CVE-2026-47208 Remote Code Execution Vulnerability |
CVE-2026-47208 |
server-webapp |
1 |
| SERVER-WEBAPP Orkes Conductor CVE-2026-58138 Unauthenticated RCE Vulnerability |
CVE-2026-58138 |
server-webapp |
1 |
| SERVER-WEBAPP Progress Kemp LoadMaster command injection attempt |
CVE-2026-8037 |
server-webapp |
1 |
| SERVER-WEBAPP Qwik CVE-2026-27971 Unsafe Deserialization Vulnerability |
CVE-2026-27971 |
server-webapp |
1 |
| SERVER-WEBAPP TRUFFLEHUNTER TALOS-2026-2500 attack attempt |
CVE-2026-15879 |
server-webapp |
1 |
| SERVER-WEBAPP WordPress Contact Form by Supsystic CVE-2026-4257 Twig SSTI cfsPreFill Injection Vulnerability |
CVE-2026-4257 |
server-webapp |
1 |
| SERVER-WEBAPP WP Activity Log CVE-2026-54806 PHP Object Injection via User-Agent Vulnerability |
CVE-2026-54806 |
server-webapp |
1 |
The Sophos NDR Active threat intelligence shields the network from known attacks by matching the
network traffic against the signatures in the NDR Ati Signature Database. These signatures are
developed to significantly increase detection performance and reduce the false alarms.
Applicable to: XGS-87, XGS-87w, XGS-107,
XGS-107w, XGS-116, XGS-116w, XGS-126, XGS-126w, XGS-136, XGS-136w, XGS-88, XGS-88w,
XGS-108, XGS-108w, XGS-118, XGS-118w, XGS-128, XGS-128w, XGS-138, XGS-2100,
XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500, and Any virtual deployment with
RAM < 24GB
The table below provides details of Signature included in this release.
This NDR Ati Release includes Zero(0) Signature
to address
Zero(0) Vulnerability.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
The Sophos NDR Active threat intelligence shields the network from known attacks by matching
the network traffic against the signatures in the NDR Ati Signature Database. These
signatures are developed to significantly increase detection performance and reduce the
false alarms.
Applicable to: XGS-5500, XGS-6500, XGS-7500,
XGS-8500 and Any virtual deployment with RAM > 24GB
The table below provides details of Signature included in this release.
This NDR Ati Release includes Zero(0) Signature
to address
Zero(0) Vulnerability.
Fixed issues, listed by ID, description, explanation and Workaround.
| Name |
CVE-ID |
Category |
Severity |
Name: Name of the Signature.
CVE-ID: CVE Identification Number - Common
Vulnerabilities and Exposures (CVE) provides reference of CVE Identifiers for
publicly known information security vulnerabilities.
Category: Class type according to threat.
Severity: Degree of severity - The levels of
severity are described in the table below:
Fixed issues, listed by ID, description, explanation and
Workaround.
| Severity Level |
Severity Criteria |
| 1 |
Critical |
| 2 |
Major |
| 3 |
Moderate |
| 4 |
Minor |
| 5 |
Warning |
Important Notice
Sophos Technologies Pvt. Ltd. has supplied this Information believing it to be
accurate and reliable at the time of printing, but is presented without warranty
of any kind, expressed or implied. Users must take full responsibility for their
application of any products. Sophos Technologies Pvt. Ltd. assumes no
responsibility for any errors that may appear in this document. Sophos
Technologies Pvt. Ltd. reserves the right, without notice to make changes in
product design or specifications. Information is subject to change without
notice.
RESTRICTED RIGHTS
©1997 - 2026 Sophos Ltd. All rights reserved.
All rights reserved. Sophos, Sophos logo are trademark of Sophos Technologies
Pvt. Ltd.
Corporate Headquarters
Sophos Technologies Pvt. Ltd.
Registered in England and Wales No. 2096520,
The Pentagon, Abingdon Science Park,
Abingdon, OX14 3YP, UK
Web site: www.sophos.com