Local Privilege Escalation in Sophos Endpoint

Sophos has disclosed a security vulnerability affecting Sophos Endpoint software that permits a local attacker to perform privilege escalation. This vulnerability allows an attacker who already possesses local access to the target system to elevate their permissions to administrative level. Upon successful exploitation, the attacker can execute arbitrary code with SYSTEM or Administrator privileges. This flaw poses a significant risk to organizational security, as it bypasses standard access control mechanisms. Defenders should prioritize identifying systems running vulnerable versions of Sophos Endpoint and ensure they are patched to the latest version provided by the vendor. This is a local vector, meaning the attacker must first establish a foothold on the endpoint through other means.

Impact

Successful exploitation of this vulnerability results in full administrative compromise of the affected host. This allows an attacker to disable security controls, deploy malware, exfiltrate sensitive data, or establish persistence at the highest privilege level. The impact is critical for any endpoint where a threat actor has achieved initial low-privileged access.

Recommendation

• Monitor security bulletins from Sophos for the release of patches addressing this privilege escalation vulnerability and apply them immediately.
• Audit systems for unauthorized local user accounts or recent privilege elevation activities that could indicate an attacker is attempting to exploit such vulnerabilities.
• Limit local administrative rights to the minimum set required for business operations to reduce the potential impact of local privilege escalation.