Actively exploited in the wild

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid - SysAid On-Prem · Listed in the CISA KEV since 2025-07-22. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-2775

CriticalCVSS 9.3KEV

Published: 07/05/2025(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

SysAid On-Prem versions up to 23.3.40 contain an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

Risk Assessment

An unauthenticated attacker can take over the administrator account and read sensitive files, potentially leading to full system compromise.

Recommendation

Immediately upgrade SysAid On-Prem to a version newer than 23.3.40 and apply security patches provided by the vendor.

Other vulnerabilities in SysAid On-Prem

CVE-2025-2776CriticalActively exploited
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Original NVD description (English source)

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.