CVE-2021-25269: Sophos Exploit Prevention

Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.

Affected products

• Sophos Exploit Prevention: before 3.8.3 (fixed in 3.8.3)
• Sophos Intercept X Endpoint: before 2.0.23 (fixed in 2.0.23)
• Sophos Intercept X For Server: before 2.0.23 (fixed in 2.0.23)

Published 2021-11-26. Last modified 2026-06-17.