Loading story…
Sophos disclosed and remediated three high-severity local privilege escalation vulnerabilities in Sophos Endpoint and Workload Protection for Windows, Sophos Central Device Encryption, and the Windows installer, tracked as CVE-2024-13972, CVE-2025-7433, and CVE-2025-7472. The flaws could allow a local user to gain SYSTEM privileges, and CVE-2025-7433 could also enable arbitrary code execution. Sophos said customers using the default Recommended update policy generally received fixes automatically, while organizations on FTS, LTS, or using older installer packages must upgrade manually and, for installer-related exposure, download a fresh installer from Sophos Central.
Details published on CVE-2025-7433 describe a CWE-502 deserialization of untrusted data issue in the encryption service of Sophos Intercept X for Windows with Central Device Encryption, affecting versions prior to 2025.1 and allowing crafted serialized payloads to run code as SYSTEM during configuration, policy, or inter-process message handling. Sophos said fixes are available in FTS 2024.3.2 and later and LTS 2024.1.1.50 and later. The disclosure follows an earlier Device Encryption privilege-escalation bug, CVE-2024-8885, which allowed arbitrary file writing in version 2024.2.0 and older and was fixed in 2024.2.1.6; Sophos credited external researchers including Filip Dragovic of MDSec, Sina Kheirkhah of watchTowr, and Sandro Poppi via its bug bounty program.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Sophos disclosed and fixed three independent high-severity local privilege escalation vulnerabilities affecting Sophos Endpoint and Workload Protection for Windows, Sophos Central Device Encryption, and the Windows installer. The flaws were tracked as CVE-2024-13972, CVE-2025-7433, and CVE-2025-7472, and Sophos said default-policy customers generally receive updates automatically while some FTS, LTS, and older installer users must upgrade manually.
Sophos included remediation for the local privilege escalation vulnerability CVE-2024-8885 in Device Encryption version 2024.2.1.6. The fix addressed an arbitrary file write issue affecting Sophos Intercept X for Windows with Central Device Encryption version 2024.2.0 and older.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
sophos.com
Open sourcesophos.com
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos released security updates for **Sophos Firewall** to remediate three vulnerabilities affecting version **21.0 GA (`21.0.0`) and earlier**, including two critical issues tracked as `CVE-2024-12727` and `CVE-2024-12728`. According to public advisories, `CVE-2024-12727` is an SQL injection flaw in the email protection feature that can expose the internal firewall database and, under specific **HA** and **SPX** conditions, lead to remote code execution. `CVE-2024-12728` stems from an improperly handled SSH password used during HA cluster initialization that remains active after setup, potentially enabling unauthorized system access. A third flaw, `CVE-2024-12729`, affects the **User Portal** and allows an authenticated remote attacker to perform command injection and achieve remote code execution. Sophos said devices with automatic hotfix installation enabled receive the fixes automatically, and the company published guidance for administrators to verify whether the hotfixes have been applied successfully. Organizations running affected firewall versions have been urged to confirm patch status promptly because the vulnerabilities impact perimeter security infrastructure and could expose management access or enable code execution on the device.
Jul 24, 2026
BeyondTrust disclosed two high-severity local vulnerabilities in **Endpoint Privilege Management (EPM) for Windows** that affect Windows Deployment versions released before **26.1.2**. The issues, tracked as `CVE-2026-40144` and `CVE-2026-40145`, were detailed in advisory **BT26-04** and echoed in alert **AV26-826** from the Canadian Centre for Cyber Security, which urged organizations to review the vendor guidance and apply updates as they become available. `CVE-2026-40144` is a kernel-mode out-of-bounds read flaw that could allow a local non-admin user to corrupt kernel memory and execute arbitrary code in kernel mode, potentially taking full control of an endpoint. `CVE-2026-40145` is an insufficient access-control issue in an EPM support utility tied to anti-tamper protections that could let an already privileged local attacker run code outside the intended anti-tamper scope. BeyondTrust said both flaws were fixed in version **26.1.2** and reported no evidence of exploitation before remediation, while recommending prompt upgrades and monitoring for privilege-escalation activity, kernel crashes, suspicious EPM utility behavior, and attempts to disable endpoint security controls.
Aug 19, 2026
Microsoft released its August 2026 security updates to address **420 newly disclosed vulnerabilities** across its product portfolio, according to alerts published by CSIRT Italia and CERT-PY. The advisories highlight one **zero-day** and three Windows flaws drawing particular attention because they are either under active exploitation or have publicly available proof-of-concept code: `CVE-2026-68820`, `CVE-2026-72971`, and `CVE-2026-62832`. `CVE-2026-68820` affects the **Windows Ancillary Function Driver for WinSock** and is a use-after-free bug that could allow a locally authenticated attacker to win a race condition and obtain **SYSTEM** privileges. `CVE-2026-72971`, in the **Windows Container Isolation FS Filter Driver**, and `CVE-2026-62832`, in the **Windows User Profile Service**, are link-following issues that can enable unauthorized local actions; the latter could let an attacker access or modify another local user’s registry hive and potentially escalate to administrative privileges. The notices urge organizations to deploy the updates through **Windows Update** and review Microsoft’s **MSRC Update Guide** and release notes for affected products.
Aug 13, 2026