CVE-2025-7472: Intercept X for Windows Privilege Escalation

CVE-2025-7472 Overview

CVE-2025-7472 is a local privilege escalation vulnerability in the Sophos Intercept X for Windows installer prior to version 1.22. When the installer runs under the SYSTEM account, a local user can leverage the flaw to elevate privileges to SYSTEM level. The weakness is categorized under [CWE-427] Uncontrolled Search Path Element, a class of defect commonly abused through DLL search order hijacking. Sophos disclosed the issue in advisory SA-20250717 and released a corrected installer.

Critical Impact
A local, authenticated user can obtain full SYSTEM privileges on affected Windows hosts when the vulnerable Intercept X installer is executed with elevated rights.

Affected Products

Sophos Intercept X for Windows installer versions prior to 1.22
Deployments where the installer is executed under the SYSTEM account
Windows endpoints receiving Intercept X via managed deployment tooling

Discovery Timeline

2025-07-17 - Sophos publishes security advisory SA-20250717
2025-07-17 - CVE-2025-7472 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7472

Vulnerability Analysis

The vulnerability resides in the Intercept X for Windows installer prior to version 1.22. It is classified as [CWE-427] Uncontrolled Search Path Element, a defect pattern in which a Windows binary resolves dependent libraries or helper executables using a search path that includes attacker-writable locations. When the installer executes with SYSTEM privileges, any binary it loads from an untrusted path inherits those privileges.

The attack requires local access and user interaction, and the exploitation conditions are constrained. However, a successful attack fully compromises confidentiality, integrity, and availability of the host and changes the security scope, meaning impact extends beyond the vulnerable component.

Root Cause

The root cause is the installer's reliance on an uncontrolled search path when resolving supporting binaries during setup. Windows resolves unqualified library references through a defined search order that includes the current working directory and other locations that may be writable by non-privileged users. If a malicious binary is planted along that search order, the SYSTEM-level installer process loads and executes it.

Attack Vector

Exploitation requires a local, low-privileged user on the target host and user interaction to launch or continue the installer. A common pattern for [CWE-427] issues is to place a crafted DLL with a name matching a library the installer loads without a fully qualified path into a directory that the installer searches before System32. When an administrator or automation runs the installer as SYSTEM, the planted DLL executes with SYSTEM privileges.

No public proof-of-concept exploit is referenced in the advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Sophos Security Advisory SA-20250717 for vendor-supplied technical details.

Detection Methods for CVE-2025-7472

Indicators of Compromise

Unexpected DLL or executable files written to directories on the installer's search path shortly before an Intercept X installation event.
Child processes of the Intercept X installer spawning under NT AUTHORITY\SYSTEM with command lines that do not match Sophos-signed binaries.
Unsigned or non-Sophos-signed modules loaded into the installer process during setup.

Detection Strategies

Hunt for module loads by the Intercept X installer where the loaded image path is outside Program Files, Program Files (x86), or System32.
Correlate file-create events for .dll files in user-writable locations with subsequent execution by a SYSTEM-privileged installer process.
Compare installed installer versions against 1.22 or later across the fleet and flag hosts running older builds.

Monitoring Recommendations

Enable Windows image-load auditing (Sysmon Event ID 7) on endpoints that receive Intercept X deployments.
Log and review all interactive or scripted executions of the Intercept X installer, including the account context used.
Alert on process creation where the parent is the installer and the child image is unsigned or resides in a user-writable path.

How to Mitigate CVE-2025-7472

Immediate Actions Required

Upgrade the Intercept X for Windows installer to version 1.22 or later before performing any new installations or reinstallations.
Remove any older installer binaries from shared file locations, deployment shares, and endpoint download directories.
Restrict who can place files in directories used to stage or execute the Intercept X installer.

Patch Information

Sophos addressed CVE-2025-7472 in Intercept X for Windows installer version 1.22. Administrators should obtain the current installer directly from Sophos and validate its digital signature before deployment. Full remediation guidance is available in the Sophos Security Advisory SA-20250717.

Workarounds

Run the installer only from a directory that non-privileged users cannot modify, such as an administrator-controlled path with restricted ACLs.
Avoid launching the installer through SYSTEM-context automation until the fixed version 1.22 is in use.
Verify that no user-writable directories precede system directories in any deployment script's working directory or PATH.

bash

# Configuration example: verify installed Intercept X installer version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Sophos\*" |
  Select-Object DisplayName, DisplayVersion |
  Where-Object { $_.DisplayName -like "*Intercept X*" }