CVE-2024-8885

This is a local privilege-escalation flaw in Sophos Intercept X with Central Device Encryption, where an insecure-deserialization weakness allows writing arbitrary files. The pointed irony is that the vulnerable software is a security and encryption product running with high privilege; abusing it lets a low-privileged local user write files they shouldn't, a classic stepping stone to full control of the host.

The vector is local and needs an existing low-privilege foothold, so this isn't an intrusion starter — it's what an attacker reaches for after landing on a machine to climb toward SYSTEM. Arbitrary file write from a low-privilege account against a highly privileged security agent is a strong escalation primitive, and the scope change signals the impact reaches beyond the component's own boundary.

We treat this as post-compromise escalation on endpoints and prioritize it through the lens of what runs everywhere. Endpoint security agents are deployed fleet-wide, so a version behind on this fix is a uniform escalation path across many machines. The control is straightforward — get the Sophos agent updated across the estate — but we rank it seriously because it turns any minor local foothold into a route to full host takeover.