Loading story…
Thermo Scientific Xcalibur and Foundation software for Windows were found to contain a local privilege escalation flaw tracked as CVE-2024-55957, caused by improper access controls that let low-privileged users overwrite executables and DLLs in the Thermo Foundation installation directory. Because one or more associated services run as NT AUTHORITY\SYSTEM, an attacker could replace service binaries or libraries and gain elevated privileges after a service restart or reboot. Tier Zero Security said it discovered the issue during an October 2024 engagement, and Thermo Fisher issued a security bulletin and patch on January 22, 2025.
A later review found the fix was incomplete: in a new installation path, Authenticated Users still had full write permissions on service executables and DLLs, leaving the underlying escalation path in place. Tier Zero Security reported the residual issue to Thermo Fisher on February 8, 2025, and Thermo Fisher later updated its bulletin to instruct customers to contact technical support for a script to correct file permissions. At the time of the follow-up disclosure, no fully patched software release had been made publicly available, leaving affected organizations dependent on vendor guidance and manual remediation.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Thermo Fisher updated its original security bulletin to instruct customers to contact technical support for a script to correct the affected file permissions. The update indicated a workaround-style remediation rather than a fully patched software release.
Tier Zero Security reported to Thermo Fisher that the January remediation was incomplete. The report stated that insecure file permissions still allowed the local privilege escalation condition to remain.
Thermo Fisher released a security bulletin and patch for CVE-2024-55957. The issue affected Thermo Scientific Xcalibur and Foundation software on Windows.
Tier Zero Security discovered a local privilege escalation vulnerability affecting Thermo Scientific Xcalibur and Foundation software during an engagement. The flaw involved improper access controls that let low-privileged users overwrite executables and DLLs, including service binaries running as SYSTEM.
After reviewing the newly patched version, Tier Zero Security found the software had moved to a new installation path but Authenticated Users still had full write permissions on affected executables and DLLs. This showed the underlying privilege escalation issue persisted despite the patch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
tierzerosecurity.co.nz
Open sourcetierzerosecurity.co.nz
Open sourceassets.thermofisher.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos disclosed and remediated three high-severity local privilege escalation vulnerabilities in **Sophos Endpoint and Workload Protection for Windows**, **Sophos Central Device Encryption**, and the Windows installer, tracked as `CVE-2024-13972`, `CVE-2025-7433`, and `CVE-2025-7472`. The flaws could allow a local user to gain **SYSTEM** privileges, and `CVE-2025-7433` could also enable arbitrary code execution. Sophos said customers using the default **Recommended** update policy generally received fixes automatically, while organizations on **FTS**, **LTS**, or using older installer packages must upgrade manually and, for installer-related exposure, download a fresh installer from Sophos Central. Details published on `CVE-2025-7433` describe a **CWE-502 deserialization of untrusted data** issue in the encryption service of Sophos Intercept X for Windows with Central Device Encryption, affecting versions prior to **2025.1** and allowing crafted serialized payloads to run code as **SYSTEM** during configuration, policy, or inter-process message handling. Sophos said fixes are available in **FTS 2024.3.2** and later and **LTS 2024.1.1.50** and later. The disclosure follows an earlier Device Encryption privilege-escalation bug, `CVE-2024-8885`, which allowed arbitrary file writing in version **2024.2.0** and older and was fixed in **2024.2.1.6**; Sophos credited external researchers including **Filip Dragovic** of MDSec, **Sina Kheirkhah** of watchTowr, and **Sandro Poppi** via its bug bounty program.
Jun 29, 2026
Splunk has disclosed two high-severity vulnerabilities, CVE-2025-20386 and CVE-2025-20387, affecting its Enterprise and Universal Forwarder products on Windows platforms. These flaws arise from incorrect NTFS file permissions set during installation and upgrades, allowing non-administrator users to access, modify, or overwrite sensitive files within the Splunk installation directories. The vulnerabilities enable local privilege escalation, potentially allowing attackers or compromised users to gain administrative access, alter configurations, or execute malicious code under elevated privileges. No active exploitation has been reported, but the risk remains significant for unpatched systems. The vulnerabilities impact both new installations and upgrades, with affected directories containing executable binaries, configuration files, and scripts critical to Splunk's operation. Attackers with local access could replace binaries, modify configuration files, inject malicious startup scripts, or hijack supporting executables, leading to full system compromise. Splunk has released patched versions (10.0.2, 9.4.6, 9.3.8, and 9.2.10) and strongly advises customers to upgrade immediately to mitigate these risks and prevent potential privilege escalation attacks.
Jun 29, 2026
Microsoft disclosed and patched multiple **elevation-of-privilege vulnerabilities** in the **Windows Common Log File System (CLFS) Driver**, including `CVE-2026-40407`, `CVE-2025-62470`, and `CVE-2025-32713`. The most detailed advisory, for `CVE-2026-40407`, describes a **heap-based buffer overflow** (`CWE-122`) that allows a locally authenticated low-privilege attacker to escalate to **SYSTEM** without user interaction. Microsoft rated `CVE-2026-40407` as **Important** with a **CVSS 3.1 score of 7.8**, citing **high** impact to confidentiality, integrity, and availability. The company said the flaw had **not** been publicly disclosed and was **not** being exploited in the wild at the time of publication, assessed exploitation as unlikely, and released an official security update to remediate the issue; the related CLFS advisories indicate a continuing pattern of privilege-escalation risk in this Windows component.
Jul 12, 2026