CVE-2025-7433: Sophos Intercept X Privilege Escalation Flaw

CVE-2025-7433 Overview

CVE-2025-7433 is a local privilege escalation vulnerability affecting Sophos Intercept X for Windows with Central Device Encryption version 2025.1 and earlier. The flaw is rooted in insecure deserialization ([CWE-502]) and allows an authenticated local attacker to execute arbitrary code with elevated privileges. Sophos published advisory SA-20250717 describing the issue and providing a fix. The vulnerability affects an endpoint security product, which increases operational impact because compromise leads to code execution in a highly privileged security-agent context.

Critical Impact
A low-privileged local user can achieve arbitrary code execution with elevated privileges on Windows hosts running vulnerable Sophos Intercept X with Central Device Encryption.

Affected Products

Sophos Intercept X for Windows with Central Device Encryption 2025.1
Sophos Intercept X for Windows with Central Device Encryption versions prior to 2025.1
Windows endpoints running the affected Sophos agent

Discovery Timeline

2025-07-17 - Sophos publishes advisory SA-20250717 and CVE-2025-7433 is published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7433

Vulnerability Analysis

CVE-2025-7433 is an insecure deserialization vulnerability ([CWE-502]) in Sophos Intercept X for Windows with Central Device Encryption. The affected component processes serialized data without sufficient validation of type or origin. An authenticated local attacker can supply crafted serialized input that the vulnerable code deserializes into attacker-controlled objects. Deserialization then triggers execution paths that lead to arbitrary code execution in the context of the privileged Sophos service.

Because the affected product runs as a Windows security agent with elevated privileges, successful exploitation escalates the attacker from a standard user context to a higher privilege level. The scope change reflected in the CVSS vector indicates that the exploited component and the impacted component operate under different security authorities, which is consistent with a low-privileged process influencing a SYSTEM-level service. See the Sophos Security Advisory SA-20250717 for vendor details.

Root Cause

The root cause is unsafe deserialization of untrusted input. The vulnerable code path accepts serialized objects from a local channel accessible to non-privileged users and reconstructs them without enforcing an allow-list of expected types. Deserialization of attacker-controlled types invokes gadget chains that execute arbitrary code inside the privileged process.

Attack Vector

Exploitation requires local access and low privileges. No user interaction is needed. An attacker with an interactive session or code execution as a standard user submits a crafted serialized payload to the vulnerable Sophos component. The component deserializes the payload and executes attacker code with the elevated privileges of the Sophos service.

// No public proof-of-concept code is available for CVE-2025-7433.
// Refer to the Sophos advisory SA-20250717 for vendor technical details.

Detection Methods for CVE-2025-7433

Indicators of Compromise

Unexpected child processes spawned by Sophos service executables running as NT AUTHORITY\SYSTEM
New or modified files under Sophos installation directories not associated with a legitimate update
Local IPC or named-pipe activity from non-privileged user processes targeting Sophos endpoints
Windows Event Log entries showing service crashes or restarts of Sophos Central Device Encryption components

Detection Strategies

Monitor process lineage on Windows endpoints and alert when Sophos processes launch shells, script interpreters, or LOLBins
Inspect endpoint telemetry for privilege transitions where a standard user process influences a SYSTEM-level Sophos component
Correlate deserialization-related exceptions in application logs with subsequent privileged process activity

Monitoring Recommendations

Track installed versions of Sophos Intercept X and Central Device Encryption across the fleet to identify unpatched hosts
Enable Windows process creation auditing (Event ID 4688) with command-line logging on endpoints running Sophos agents
Forward endpoint and Sophos application logs to a central SIEM for correlation and retention

How to Mitigate CVE-2025-7433

Immediate Actions Required

Upgrade Sophos Intercept X for Windows with Central Device Encryption to a version later than 2025.1 as directed in advisory SA-20250717
Inventory Windows endpoints to identify hosts still running vulnerable Sophos agent versions
Restrict interactive logon on servers and privileged workstations to limit local attack surface

Patch Information

Sophos addressed CVE-2025-7433 in updates released alongside advisory SA-20250717. Administrators should confirm that managed endpoints have received the fixed version through Sophos Central. Refer to the Sophos Security Advisory SA-20250717 for exact fixed versions and deployment guidance.

Workarounds

No vendor-provided workaround exists; applying the update is the required remediation
Reduce risk by enforcing least privilege and preventing untrusted users from obtaining local sessions on affected hosts
Monitor Sophos agent health to detect tampering while patch deployment is in progress

bash

# Verify installed Sophos product version on a Windows endpoint (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Sophos\*" |
    Select-Object PSChildName, ProductVersion, InstalledVersion