InfoSecBulletin Cybersecurity for mankind
Sophos fixed an authentication bypass vulnerability in its AP6 Series Wireless Access Points, preventing attackers from obtaining admin privileges. The company found the issue during internal security tests and has issued a firmware update to fix it.
An attacker with network access to the access point’s management IP can bypass authentication. This exploit provides them with administrator privileges on the device.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
This elevated access can help control the access point, intercept or change network traffic, disrupt wireless connections, or use the compromised device to launch further attacks.
Sophos reported that the vulnerability was found by its own team, highlighting a proactive approach to product security. The nature of the flaw, requiring access to the management interface, suggests that the primary risk is from attackers already on the local network.
Sophos Wireless Access Points Vulnerability:
Sophos AP6 Series Wireless Access Points with firmware versions before 1.7.2563 (MR7) have a vulnerability. A fix is available in firmware version 1.7.2563 (MR7), released after August 11, 2025.
Administrators should check that their access points are using this version or a newer one for protection. Organizations using old firmware are at risk and need to upgrade for security fixes to protect their networks.
Most customers have an automatic remediation process. Sophos AP6 devices are set up to install updates automatically, so patched firmware is applied without any manual effort.
This policy helps most users stay protected automatically. However, those who chose not to receive updates need to update manually. Users must upgrade their AP6 Series firmware to version 1.7.2563 (MR7) or newer to apply the patch.
While Sophos has indicated that no exploitation has been observed in the wild, the high CVSS score of 9.8 reflects the seriousness of the vulnerability and the potential damage if left unpatched.
