Replace the old Sophos SSL VPN Client and migrate startup

The old Sophos SSL VPN Client for Windows should no longer be installed or operated. It has been End of Life since January 31, 2022, and CVE-2021-36809 affects all versions. A local attacker can use administrator privileges to overwrite arbitrary system files with VPN client logs, potentially causing a denial of service and data loss. Sophos will not fix the vulnerability; remediation requires migration to Sophos Connect v2. Since SFOS 20.0 MR1, the legacy client also no longer establishes remote access SSL VPN tunnels.

Compatibility status as of September 7, 2026: For SFOS 22, Sophos Connect is the supported Sophos client. Sophos Connect 2.5 MR1 and earlier for Windows and 2.0 MR1 and earlier for macOS are listed as compatible. These are firewall compatibility ceilings, not a recommendation to run an old client. Before rollout, use Check and update the Sophos Connect Client version safely to select the current approved release and review its known issues.

The secure solution is to migrate to Sophos Connect: prepare a current profile and installer, uninstall the old client, import and test the connection, and then remove startup entries, plaintext files, and old profiles completely. For help choosing the right remote access model, see Sophos Connect or SSL VPN: Which solution fits?.

⚠️ If the affected device provides the only remote administrator access, arrange an alternative access method or a maintenance window with local access before uninstalling the client. The EOL client is not a secure fallback.

Migrate to Sophos Connect

1. Inventory affected Windows versions, CPU architectures, user groups, MFA/SSO, and the installed legacy version. Keep alternative administrator access and an approved Sophos Connect package ready for the pilot.
2. Prepare the current Sophos Connect installer and a fresh .ovpn file from the VPN portal. In SFOS 22, the web admin path is Remote access VPN > SSL VPN > Download client; users obtain the client and profile under VPN Portal > VPN. The complete click paths are documented in Set up Sophos SSL VPN with Sophos Connect on Windows.
3. If the VPN portal is unavailable, copy only the existing .ovpn file from the legacy configuration folder to a protected temporary folder. Do not copy a password.txt file.
4. If the copied profile contains auth-user-pass password.txt, remove the filename from the copy so that only auth-user-pass remains.
5. Disconnect the VPN and uninstall the old Sophos SSL VPN Client normally under Settings > Apps > Installed apps. Sophos Connect is not installed alongside the legacy client; do not manually delete unknown drivers or services.
6. Restart Windows, install Sophos Connect, and import the current .ovpn file or the cleaned profile copy using Import connection.
7. Connect with a pilot user and, if configured, MFA or SSO. Check the VPN address, DNS, allowed and blocked destinations, and reconnection. Only then expand the rollout and remove the remaining legacy artifacts.

Sophos Connect and its profiles should then be maintained through a defined update process. See Check and update the Sophos Connect Client version safely.

Identify legacy startup entries and plaintext credentials

Check startup and the Run value

In Task Manager, open Startup apps and look for SSL VPN Client for Windows, then disable the entry.

A custom startup value may also exist for the current user:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

A legacy value can be identified by openvpn-gui.exe, --config_dir, and --connect. The following pattern is for identification only and must not be created:

"C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe" --config_dir "C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\" --connect <profile-name>.ovpn

Remove only the value that clearly belongs to the old Sophos client. Never delete the entire Run key or unknown entries. For older installations, also check the classic Windows Startup folder. In managed environments, determine whether a GPO or software deployment recreates the value.

Check the OVPN profile and password.txt

Legacy profiles are often stored in one of these locations:

• 64-bit Windows: C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\
• older 32-bit installations: C:\Program Files\Sophos\Sophos SSL VPN Client\config\

The actual Run value and local installation are more reliable than an assumed default path.

A problematic file reference looks like this:

auth-user-pass password.txt

The referenced file contains the username and password in plaintext. Do not open, display, or attach this file to support data. For the migration, leave only normal interactive authentication in a copy of the profile:

auth-user-pass

As soon as alternative administrator access and the cleaned profile are available, delete the referenced password file and every copy before the first Sophos Connect sign-in. Change the affected account’s password in the responsible identity system, check the VPN logs for unexpected sign-ins, and use the new password for the pilot test. After a successful migration, delete legacy profiles that are no longer needed. Deleting only the file is not sufficient.

Auto-connect without password.txt

A Sophos Connect provisioning file (.pro) can import and update profiles automatically. With auto_connect_host, the client checks a host that is reachable only on the internal network. If that host is unreachable, Sophos Connect enables the connection; the tunnel is established automatically only with saved credentials or after a previous SSO sign-in.

[
  {
    "display_name": "Company VPN",
    "gateway": "vpn.example.com",
    "vpn_portal_port": 443,
    "auto_connect_host": "intranet.corp.example",
    "can_save_credentials": false
  }
]

With can_save_credentials: false, the client does not store the user’s password. Without SSO, the user must still sign in. If SSO was the last sign-in method, Sophos Connect can establish the tunnel automatically using SSO. This example is intentionally minimal; classic Sophos Firewall OTP requires additional otp and 2fa fields. The linked Sophos Connect provisioning guide explains these fields and GPO deployment; for authentication, see MFA on Sophos Firewall or Microsoft Entra ID SSO for Sophos Connect.

Keep three functions separate: Windows starts the Sophos Connect application, .pro imports or updates profiles, and auto_connect_host triggers a connection according to network location. None is a supported replacement for password.txt. The example contains no username or password and cannot create an unattended tunnel without a previous SSO sign-in. Auto-connect is also not a pre-logon device tunnel before Windows user sign-in.

For Microsoft Entra ID SSO, Sophos specifies Sophos Connect 2.4 or later on Windows with SFOS 21.5 or later. The Sophos Connect update guide also covers version selection and known issues: 64-bit Windows 10/11 and Windows 10/11 on ARM are documented for 2.5 and later; Windows 11 Enterprise Multi-session, including Azure Virtual Desktop, is unsupported. .pro provisioning is documented for Windows, not macOS.

Test shared Windows devices with at least two user accounts. According to the same guide, Sophos Connect 2.5 MR1 fixes NCL-2570, where the client did not start automatically for additional Windows users when another user installed it. An update does not replace the multi-user test, and “client started” still does not mean “VPN connected.”

Provisioning requires an accessible VPN portal. If it is exposed from the WAN, use a trusted certificate, MFA, monitoring, and the narrowest possible Device Access and Local Service ACL configuration.

Verify the migration and isolate errors

After the migration, check the connection and the cleanup separately:

• The old client, its Task Manager startup entry, and the specific HKCU Run value have been removed.
• No password.txt remains in the old profile path or software deployment.
• A migrated profile does not contain a file reference after auth-user-pass.
• Sophos Connect uses the intended current connection and client version.
• Authentication, MFA, or SSO works.
• The client receives an address from the expected VPN pool.
• Internal DNS names and permitted destinations work, while explicitly blocked networks remain blocked.
• Log Viewer shows the expected user and the correct remote access rule.

Sophos Connect cannot be installed

Check whether the old Sophos SSL VPN Client is still installed. Uninstall it normally, restart Windows, and try the installation again. If other VPN clients conflict, do not remove drivers or services speculatively.

The profile is imported, but the tunnel does not start

Import a current .ovpn file from the VPN portal again and check the policy assignment, user account, MFA, and Sophos Connect events. On the firewall, sslvpn.log, openvpn-status*.log, and, for authentication problems, access_server.log can help depending on the error.

The tunnel is connected, but internal destinations do not work

The problem is then usually related to the policy, firewall rule, DNS, routing, or MTU. Use Test a firewall rule with Log Viewer, Policy Test, and Packet Capture, Sophos Firewall services and logs, and, for stalled applications, MTU and MSS for VPN problems.

Sophos Connect starts but does not connect automatically

First check whether a .pro profile is used and whether auto_connect_host contains a stable FQDN reachable only internally. Test the same host inside the corporate network and externally. If it is also reachable externally, auto-connect remains off; if it is unreliable internally, the connection may be activated unnecessarily. Then check whether the user previously signed in with SSO. With can_save_credentials: false and no previous SSO sign-in, an interactive sign-in is expected.

Safe rollback

Rollback does not mean returning to the vulnerable legacy client. Before the pilot migration, retain the approved Sophos Connect package, cleaned profile, and alternative administrator access. If the new client fails, first preserve Sophos Connect events and scvpntsr.zip, then stop the rollout and GPO deployment. Uninstall the faulty Sophos Connect version normally, restart if required, and install the last approved Sophos Connect version with its tested profile.

Retest sign-in, MFA/SSO, VPN address, DNS, and allowed and blocked destinations. Revert firewall, portal, or policy changes only when no migrated users depend on them. Do not restore the legacy installer, password.txt, or old Run value as rollback artifacts.

FAQ