10.0.4 Network Extension App - Excessive CPU Usage

We had identified and fixed the issue that we believed was causing the excessive CPU usage with the Network Extension app but as many of you are still encountering the problem there is obviously something else going on, something that we've so far been unable to reproduce.

We've started this thread to collect and collate the details on the occurrences of this on 10.0.4 and as a place to post your SDUs.

We still believe that network connectivity issues and the high CPU are unrelated as the Network Extension app is not directly involved in network activity, as it behaves as a watcher to the actual network extension which is what performs the actual interception.

Thank you for your continued feedback and your patience.

  • Have this happening on multiple devices now.  From the VPN disconnecting issue to the Network Extension showing excessive CPU usage.  Here's 2:



    We have started to uninstall Sophos for all affected users now as it basically makes them unable to work and will start evaluating other vendors as this is just not acceptable.

  • Thank you for the SDUs. I will be analyzing them.
    Sorry for the disruption this has caused.

  • Although having users with high CPU usage here.

    SDU: 36c3550a-c213-94f3-49de-f817302fb237_2021-03-09-14-07-48.zip

  • Here is the SDU from a Mac that is experiencing Excessive CPU Usage. 


  • I am still experiencing this on multiple systems.  I don't see a way to include an SDU on this post so I am oping a support ticket.

  • here are a few more for you to review.  



  • I have 1 Big Sur user with 2018 Macbook Pro 15" on MacOS 11.2.3 who is on Sophos 1.0.4, reporting com.sophos.endpoint.networkextension using 100% CPU (an entire core). Symptoms are: 

    • If a web page request doesn’t completely timeout it will load incompletely.
    • Laptop fans will spin up. 
    • Auto-hidden dock will no longer appear. (I don’t know how that’s connected but it’s reproducible.)

    It’s been happening every few days now.

    Problem returns after force quitting com.sophos.endpoint.networkextension, and then seems to get process com.cisco.anyconnect.macos.acsosc... involved with high CPU usage, though, Anyconnect was not being used at the time.

    I will open a support ticket. Note that we are evaluating JAMF Protect going forward, as it is integrated with our JAMF MDM, uses native MacOS functionality, and hopefully won't be as unstable as Sophos, while providing more actionable information. 

  • Thanks for opening a Support ticket. We have been working with other customers on similar issues - there's a problem we've been encountering with Cisco AnyConnect and the team has been hard at work on improving this. We're hoping improvements will be seen in the upcoming ARM Support EAP.

  • I am in the same boat. Running 10.0.4, updated from Catalina to Big Sur 11.2.3 on a 2017 13" MBP. Suddenly having issues with com.sophos.endpoint.networkextension CPU usage spiking and my AnyConnect VPN dropping as well as local web browser grinding to a halt. Submitted a case with SDU attached this morning.

    Other users have reported similar issues and I am working with them to gather additional info and SDUs to confirm the details match.