A vulnerability related to registry permissions in the Intercept X for Windows updater prior to version 2024.3.2 can lead to a local user gaining SYSTEM level privileges during a product upgrade.
https://www.sophos.com/en-us/security-advisories/sophos-sa-20250717-cix-lpe