InfoSecBulletin Cybersecurity for mankind
Sophos fixed an authentication bypass vulnerability in its AP6 Series Wireless Access Points, preventing attackers from obtaining admin privileges. The company found the issue during internal security tests and has issued a firmware update to fix it.
An attacker with network access to the access point’s management IP can bypass authentication. This exploit provides them with administrator privileges on the device.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
This elevated access can help control the access point, intercept or change network traffic, disrupt wireless connections, or use the compromised device to launch further attacks.
Sophos reported that the vulnerability was found by its own team, highlighting a proactive approach to product security. The nature of the flaw, requiring access to the management interface, suggests that the primary risk is from attackers already on the local network.
Sophos Wireless Access Points Vulnerability:
Sophos AP6 Series Wireless Access Points with firmware versions before 1.7.2563 (MR7) have a vulnerability. A fix is available in firmware version 1.7.2563 (MR7), released after August 11, 2025.
Administrators should check that their access points are using this version or a newer one for protection. Organizations using old firmware are at risk and need to upgrade for security fixes to protect their networks.
Most customers have an automatic remediation process. Sophos AP6 devices are set up to install updates automatically, so patched firmware is applied without any manual effort.
This policy helps most users stay protected automatically. However, those who chose not to receive updates need to update manually. Users must upgrade their AP6 Series firmware to version 1.7.2563 (MR7) or newer to apply the patch.
While Sophos has indicated that no exploitation has been observed in the wild, the high CVSS score of 9.8 reflects the seriousness of the vulnerability and the potential damage if left unpatched.
