CVE-2025-2776: critical vulnerability in SysAid On-Prem
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
SysAid On-Prem versions up to 23.3.40 have a security flaw where an attacker can exploit XML processing without logging in to take over administrator accounts or read sensitive files from the server.
An unauthenticated XXE vulnerability exists in the serverurl processing functionality (CWE-611) that allows attackers to inject malicious XML entities. This can be leveraged for arbitrary file disclosure and privilege escalation through administrator account compromise, with no authentication required as a pre-condition.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.