TI-2021-07521 Aliases CVE-2021-25269 GHSA-cvpr-72qq-65cc

A local administrator could prevent the HMPA service from starting despite tamper…

LOW 20CWE-428Published 2021-11-26 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-428.

Summary

A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.

Why it matters now

EPSS 0.00252 16th percentileScored 2026-11-07

Fix Fixed Intercept X Advanced (Sophos): 2.0.23Intercept X Advanced for Server (Sophos): 2.0.23+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sophos	Intercept X Advanced	before 2.0.23	2.0.23	Patch available	CNA
Sophos	Intercept X Advanced for Server	before 2.0.23	2.0.23	Patch available	CNA
Sophos	Sophos Exploit Prevention	before 3.8.3	3.8.3	Patch available	CNA

Intercept X Advanced VendorSophos Affected before 2.0.23 Fixed in 2.0.23 Patch available CNA
Intercept X Advanced for Server VendorSophos Affected before 2.0.23 Fixed in 2.0.23 Patch available CNA
Sophos Exploit Prevention VendorSophos Affected before 3.8.3 Fixed in 3.8.3 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:sophos:exploit_prevention::::::::	before 3.8.3	Vulnerable	Sophos
cpe:2.3:a:sophos:intercept_x_endpoint::::::::	before 2.0.23	Vulnerable	Sophos
cpe:2.3:a:sophos:intercept_x_for_server::::::::	before 2.0.23	Vulnerable	Sophos

cpe:2.3:a:sophos:exploit_prevention:*:*:*:*:*:*:*:* Versions before 3.8.3 Vulnerable ·Sophos
cpe:2.3:a:sophos:intercept_x_endpoint:*:*:*:*:*:*:*:* Versions before 2.0.23 Vulnerable ·Sophos
cpe:2.3:a:sophos:intercept_x_for_server:*:*:*:*:*:*:*:* Versions before 2.0.23 Vulnerable ·Sophos

Remediation

Fix · CNA Intercept X Advanced (Sophos) Fixed in 2.0.23
Fix · CNA Intercept X Advanced for Server (Sophos) Fixed in 2.0.23
Fix · CNA Sophos Exploit Prevention (Sophos) Fixed in 3.8.3

Timeline

2026-10-02 Threatist record created from CVE-2021-25269
2026-10-03 Alias added: GHSA-cvpr-72qq-65cc

References

Advisory 1

https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-ixa-hmpa-local-dos

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences