Sophos Fixes Critical Authentication Bypass (CVE-2025-10159) in AP6 Series Wireless Access Points

Sophos has released a fix for a critical authentication bypass vulnerability (CVE-2025-10159) affecting its AP6 Series Wireless Access Points, the flaw rated CVSS 9.8 could allow attackers with network access to the device’s management interface to gain full administrative control.

According to Sophos, the issue was discovered during internal security testing, not through active exploitation, and the advisory states that attackers able to reach the access point’s management IP address could gain administrator level privileges. The vulnerability affects all Sophos AP6 Series Wireless Access Points firmware prior to version 1.7.2563 (MR7), with devices running older firmware remaining vulnerable until patched.

Sophos confirmed that the issue has been patched in AP6 Series firmware version 1.7.2563 (MR7) released after 11 August 2025, and for most users no action is needed as updates are installed automatically by default. However, organisations that have opted out of automatic updates must manually upgrade their devices to the latest version, as older firmware versions require upgrading to receive the latest protections.

Wireless access points are critical entry points into enterprise and campus networks, and a flaw that allows authentication bypass and administrative privilege gains could lead to network-wide compromise and surveillance of sensitive traffic.