← Vulnerability feed

Vulnerability record · CVE-2021-25269 · published 26 November 2021

CVE-2021-25269: Sophos exploit prevention unquoted search path vulnerability

Sophos · Exploit Prevention

A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.

4.4 CVSS 3.1 Medium EPSS 0.25% · top 85.0% CWE-428 · Unquoted search path
4.4CVSS 3.1 base score, v2 2.1
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-ixa-hmpa-local-dos Vendor Advisory
https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-ixa-hmpa-local-dos Vendor Advisory

Track CVE-2021-25269 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2020-9363Sophos cloud optix interpretation conflict vulnerabilityThe Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix…EPSS 0.97%

Source: NIST National Vulnerability Database (record CVE-2021-25269), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.