Actively exploited in the wild
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
SysAid - SysAid On-Prem · Listed in the CISA KEV since 2025-07-22. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-2776
CriticalCVSS 9.3KEVSummary
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.
Risk Assessment
An attacker can take over the administrator account and read arbitrary files from the server, potentially leading to data confidentiality breach and full system compromise.
Recommendation
Immediately upgrade SysAid On-Prem to a version newer than 23.3.40 and restrict access to the URL processing functionality.
Other vulnerabilities in SysAid On-Prem
Original NVD description (English source)
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.