CyberSecurityBoard
Sponsor Register Login

Sophos Intercept X for Windows Vulnerabilities Enable Arbitrary Code Execution

The registry ACL vulnerability CVE-2024-13972 impacts all Intercept X for Windows installations prior to version 2024.3.2, as well as Fixed Term Support (FTS) 2024.3.2.23.2 and Long Term Support (LTS) 2025.0.1.1.2 releases. Identified as CVE-2024-13972, CVE-2025-7433, and CVE-2025-7472, the flaws span registry permission misconfigurations, a weakness in the Device Encryption component, and an issue in the Windows installer running under the SYSTEM account. Three critical vulnerabilities in the Sophos Intercept X for Windows product family could allow local attackers to achieve arbitrary code execution with system-level privileges. All three defects carry a High severity rating and affect versions of Intercept X for Windows before the latest patches released on July 17, 2025. Three High-severity CVEs enable local privilege escalation in Sophos Intercept X for Windows. Organizations deploying Sophos Intercept X Endpoint or Intercept X for Server must apply updates immediately or risk unauthorized elevation of privilege and potential complete system compromise. When the installer runs under the SYSTEM context, common in enterprise deployments, a local actor can exploit improper file permissions to replace or manipulate installer files and gain system-level code execution. Intercept X for Windows 2024.3.2 and the matched FTS/LTS branch versions include the CVE-2024-13972 registry fix. Device Encryption 2025.1 and its FTS/LTS counterparts resolve CVE-2025-7433, while installer version 1.22, published March 6, 2025, remediates CVE-2025-7472. Lastly, CVE-2025-7472 targets the installer for Intercept X for Windows.

This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 18 Jul 2025 13:25:13 +0000


Cyber News related to Sophos Intercept X for Windows Vulnerabilities Enable Arbitrary Code Execution

Sophos Intercept X for Windows Vulnerabilities Enable Arbitrary Code Execution - The registry ACL vulnerability CVE-2024-13972 impacts all Intercept X for Windows installations prior to version 2024.3.2, as well as Fixed Term Support (FTS) 2024.3.2.23.2 and Long Term Support (LTS) 2025.0.1.1.2 releases. Identified as ...
5 days ago Cybersecuritynews.com CVE-2024-13972
Sophos Patches EOL Firewalls Against Exploited Vulnerability - UK-based cybersecurity firm Sophos this week announced patches for an exploited vulnerability in Firewall versions that have reached End-of-Life. The critical-severity flaw, tracked as CVE-2022-3236, was found to impact versions 19.0 MR1 and older of ...
1 year ago Securityweek.com CVE-2022-3236
Windows 10 Extended Security Updates Promised for Small Businesses and Home Users - Already common for enterprises, for the first time, individuals will also get the option to pay for extended security updates for a Windows operating system that's out of support. Windows 10 will stop getting free updates, including security fixes, ...
1 year ago Techrepublic.com
Critical Sophos Firewall Vulnerabilities Enables pre-auth Remote Code Execution - Multiple security vulnerabilities affecting Sophos firewall products, with two enabling pre-authentication remote code execution that could allow attackers to compromise systems without valid credentials. Users running supported versions including ...
1 day ago Cybersecuritynews.com CVE-2025-6704
Fraudsters Successfully Inserted Cryptocurrency Programs into Apple and Google's App Stores - Scammers were able to get two malicious apps onto the app stores of both Google and Apple, allowing them to trick users into investing in fake cryptocurrency. According to a report from Sophos, the apps, Ace Pro and MBM BitScan, were found on both ...
2 years ago Therecord.media
How ransomware gangs are engaging - As ransomware gangs continue to market themselves as legitimate businesses complete with customer service representatives, new research from Sophos showed that threat actors are expanding public relations efforts to further pressure victims into ...
1 year ago Techtarget.com LockBit Snatch
Sophos backports RCE fix after attacks on unsupported firewalls - Sophos was forced to backport a security update for CVE-2022-3236 for end-of-life firewall firmware versions after discovering hackers actively exploiting the flaw in attacks. The flaw is a code injection problem in the User Portal and Webadmin of ...
1 year ago Bleepingcomputer.com CVE-2022-3236
Cybercriminals Hesitant About Using Generative AI - Cybercriminals are so far reluctant to use generative AI to launch attacks, according to new research by Sophos. Examining four prominent dark-web forums for discussions related to large language models, the firm found that threat actors showed ...
1 year ago Infosecurity-magazine.com
CISA warns of actively exploited Windows, Sophos, and Oracle bugs - The U.S. Cybersecurity & Infrastructure Security Agency has added to its catalog of known exploited vulnerabilities three security issues that affect Microsoft devices, a Sophos product, and an enterprise solution from Oracle. The KEV catalog ...
1 year ago Bleepingcomputer.com CVE-2023-36584 CVE-2023-1671 LockBit
EOL Sophos firewalls get hotfix for old but still exploited vulnerability - Over a year has passed since Sophos delivered patches for a vulnerability affecting Sophos Firewalls that was being actively exploited by attackers, and now they have pushed additional ones to protect vulnerable EOL devices. CVE-2022-3236 is a code ...
1 year ago Helpnetsecurity.com CVE-2022-3236
Microsoft No Longer Selling Windows 10 Licenses Redirects to Windows 11 Product Pages - Marking an end to an era, Microsoft is no longer directly selling Windows 10 product keys on their website, instead redirecting users to Windows 11 product pages. This month, Microsoft began displaying an alert on their Windows 10 Home and Pro ...
2 years ago Bleepingcomputer.com
Crypto scam apps infiltrate Apple App Store and Google Play - Operators of high-yielding investment scams known as "Pig butchering" have found a way to bypass the defenses in Google Play and Apple's App Store, the official repositories for Android and iOS apps. Pig butchering scams have been happening for a few ...
2 years ago Bleepingcomputer.com
Sophos Joins Security Companies in Cutting Staff - Sophos has joined the list of cybersecurity companies that are cutting staff following the implementation of measures to cope with the current global economic crisis. The Cambridge-based firm announced on May 11 that it was reducing its workforce ...
2 years ago Securityweek.com
Sophos: Remote ransomware attacks on SMBs increasing - Sophos researchers observed a shift in threat activity against small businesses in 2023, including a surge in remote ransomware attacks, according to new research published Tuesday. Although the vendor said ransomware continues to be the primary ...
1 year ago Techtarget.com
CVE-2021-25269 - A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version ...
3 years ago
20 Best Endpoint Management Tools - 2025 - What is Good?What Could Be Better?Comprehensive endpoint security against many threats.The user interface may overwhelm some users.Machine learning for real-time threat detection.Integration with existing systems may be complex.A central management ...
3 months ago Cybersecuritynews.com
CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
1 year ago Securityaffairs.com
Windows 11 to let admins mandate SMB encryption for outbound connections - Windows 11 will let admins mandate SMB client encryption for all outbound connections, starting with today's Windows 11 Insider Preview Build 25982 rolling out to Insiders in the Canary Channel. SMB encryption provides data end-to-end encryption and ...
1 year ago Bleepingcomputer.com
Windows 11 24H2 now rolling out, here are the new features - Version 24H2 is now also accessible via Windows Server Update Services (including Configuration Manager), Windows Update for Business, and the Microsoft 365 admin center. Microsoft suggests that businesses start targeted rollouts to ensure ...
9 months ago Bleepingcomputer.com
Windows Security in 2025: Battling Sophisticated Threats with Advanced Defenses - As threat actors adapt their techniques, Microsoft has responded with significant security enhancements while organizations navigate a complex threat environment dominated by privilege escalation attacks and driver vulnerabilities. This Windows ...
2 months ago Cybersecuritynews.com CVE-2025-0289
Windows 10 KB5035845 update released with 9 new changes, fixes - Microsoft has released the KB5035845 cumulative update for Windows 10 21H2 and Windows 10 22H2, which includes nine new changes and fixes. After installing this mandatory Windows 10 cumulative update, the March 2024 Patch Tuesday security updates ...
1 year ago Bleepingcomputer.com
Microsoft releases first Windows Server 2025 preview build - Microsoft has released Windows Server Insider Preview 26040, the first Windows Server 2025 build for admins enrolled in its Windows Insider program. This build is the first pushed for the next Windows Server Long-Term Servicing Channel Preview, which ...
1 year ago Bleepingcomputer.com
Microsoft adds hotpatching support to Windows 11 Enterprise - If all prerequisites are met to receive hotpatch updates, you can enable or disable them by going to Devices > 'Windows updates'> 'Create Windows quality update policy' in the Microsoft Intune admin center to create a Windows quality update ...
3 months ago Bleepingcomputer.com
Global malspam targets hotels, spreading Redline and Vidar stealers - The latest global malspam campaign targets the hotel industry, emphasizing the need to stay alert against such attacks at all times. Cybersecurity researchers at Sophos X-Ops have issued a warning to the hospitality industry about a sophisticated ...
1 year ago Hackread.com
Microsoft Patch Tuesday 2024: 49 Vulnerabilities are fixed - Microsoft released its first patch on Tuesday, 2024, in which nearly 49 vulnerabilities have been fixed in Microsoft products and 5 vulnerabilities in non-Microsoft products. Among these 49 vulnerabilities, there were 12 remote code execution ...
1 year ago Cybersecuritynews.com CVE-2024-20674 CVE-2024-20700 CVE-2024-0057

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)