CVE-2018-4863: Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by del...

Security readout for executives and security teams

CVE-2018-4863 is a local tamper-protection bypass in Sophos Endpoint Protection 10.7. A local user may be able to interfere with a Windows registry-backed Sophos Endpoint Defense setting and bypass intended protection. The sources do not provide CVSS, a vendor fix, or evidence of active exploitation. Likely limited to Windows endpoints running Sophos Endpoint Protection 10.7. Exposure beyond that version is not established in the provided sources. Risk depends on whether local users or local processes can reach the affected configuration path. Treat as a targeted hygiene issue, not an internet-scale emergency. It matters where Sophos Endpoint Protection 10.7 remains deployed because it can weaken security controls after local compromise. Prioritize inventory, vendor guidance, and upgrade planning. Mitigation focus: Inventory endpoints running Sophos Endpoint Protection 10.7.; Check Sophos guidance for fixed versions or supported upgrade paths.; Restrict local administrative rights on affected Windows endpoints..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.