Sophos Intercept X for Windows Local Privilege Escalation Vulnerability in Central Device Encryption

A local privilege escalation vulnerability allowing arbitrary code execution exists in Sophos Intercept X for Windows with Central Device Encryption versions prior to 2025.1. This vulnerability was discovered by an external security researcher and has been responsibly disclosed to Sophos.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a local user to execute arbitrary code with elevated rights.

Remediation

Users of Sophos Intercept X for Windows with Central Device Encryption should upgrade to version 2025.1 or later. For those using the default updating policy, no action is required as updates are installed automatically. However, customers on Fixed Term Support (FTS) or Long Term Support (LTS) packages must upgrade to receive these fixes.