CVE-2025-2776
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
Description
CVE-2025-2776 is a critical XML External Entity (XXE) injection vulnerability in SysAid On-Prem versions 23.3.40 and earlier, affecting the Server URL processing functionality. This unauthenticated vulnerability allows remote attackers to exploit insecure XML parsing to achieve administrator account takeover and read sensitive files from the server. Rated 9.3 (Critical) on the CVSS v3.1 scale, the vulnerability shares the same underlying weakness as CVE-2025-2775 but targets a different processing endpoint within SysAid. CISA has listed CVE-2025-2776 in the Known Exploited Vulnerabilities catalog with a remediation deadline of August 12, 2025, and its EPSS score of 57.24% at the 98th percentile confirms a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sysaid | sysaid | <= 23.3.40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://documentation.sysaid.com/docs/24-40-60(Release Notes)
- https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776(US Government Resource)
Weakness Type
CWE-611: Improper Restriction of XML External Entity Reference
CVE-2025-2776 falls under CWE-611, where an application processes XML input without properly restricting external entity references. In the SysAid On-Prem Server URL processing functionality, the XML parser accepts and resolves external entity declarations from attacker-controlled input. This enables file read primitives against the server's file system, server-side request forgery against internal services, and extraction of credentials that facilitate administrator account takeover.
Learn more: CWE-611 — Improper Restriction of XML External Entity Reference
Impact Analysis
CVE-2025-2776 carries a CVSS v3.1 base score of 9.3 (Critical) with an identical vector to CVE-2025-2775: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction needed (UI:N), and a changed scope (S:C). Confidentiality faces high impact (C:H) as the XXE enables reading arbitrary server files including credentials, tokens, and application secrets, which can be leveraged for administrator account takeover. Availability is partially impacted (A:L) as exploitation may cause service disruptions. With an EPSS score of 57.24% at the 98th percentile, this vulnerability is more likely to be exploited than virtually all other known vulnerabilities. The combination of two distinct XXE entry points (CVE-2025-2775 and CVE-2025-2776) in SysAid On-Prem significantly increases the attack surface available to threat actors.
Exploit Maturity
CVE-2025-2776 exhibits very high exploit maturity, closely tied to CVE-2025-2775 as both XXE vulnerabilities were disclosed together. CISA has confirmed active exploitation in the wild, and public exploit code and a detailed technical analysis are available from watchTowr Labs, which covers both the Checkin and Server URL XXE attack vectors. The EPSS score of 57.24% at the 98th percentile indicates near-certain exploitation activity. Given that SysAid has historically been targeted by sophisticated threat actors, including ransomware operators, and that two independent unauthenticated XXE entry points are now publicly documented, organizations running unpatched SysAid On-Prem instances face an extremely high risk of compromise.
Remediation
-
Upgrade SysAid On-Prem immediately. Install version 24.4.60 or later, which resolves both CVE-2025-2776 and the related CVE-2025-2775 vulnerability. Follow the SysAid release notes for upgrade instructions.
-
Disable XML external entity processing. As an interim control, configure the application's XML parser to disable DTD processing and external entity resolution. This prevents exploitation through both the Server URL and Checkin processing vectors.
-
Restrict access to SysAid endpoints. Use network segmentation and firewall rules to limit access to the SysAid web application to trusted internal networks only. Block all public-facing access until the patch is applied.
-
Conduct a forensic review. Examine web server logs for anomalous requests to the Server URL processing endpoint, especially those containing XML entity declarations. Check for unauthorized administrator accounts, credential theft, and signs of lateral movement from the SysAid server.
-
Rotate all credentials. After patching, rotate all SysAid administrator passwords, API keys, database credentials, and any secrets stored on or accessible from the SysAid server, as these may have been compromised through file read primitives.
Technical Details
CVE-2025-2776 is an unauthenticated XXE injection vulnerability in the SysAid On-Prem Server URL processing functionality, with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. Similar to CVE-2025-2775, this vulnerability stems from insecure XML parser configuration that permits external entity resolution. When the Server URL processing endpoint receives XML input, the parser evaluates any embedded <!DOCTYPE> or <!ENTITY> declarations, resolving references to local files or network resources. Attackers exploit this by crafting XML payloads with external entity references such as file:///etc/shadow or http://internal-service/ to read sensitive files or probe internal infrastructure. The changed scope in the CVSS vector reflects that data extracted through the XXE can be used to compromise the underlying system and connected services beyond the SysAid application itself. The watchTowr Labs research demonstrates that both XXE vectors in SysAid can be chained with credential extraction techniques to achieve full administrator takeover of the IT service management platform.
Frequently Asked Questions
Is CVE-2025-2776 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2025-2776 to the Known Exploited Vulnerabilities catalog. Public exploit details are available from watchTowr Labs, and the EPSS score of 57.24% at the 98th percentile indicates a very high exploitation probability.
What products are affected by CVE-2025-2776?
SysAid On-Prem versions 23.3.40 and earlier are affected through the Server URL processing functionality. This is a separate XXE entry point from CVE-2025-2775 (Checkin processing). Organizations should upgrade to version 24.4.60 or later.
How do I fix CVE-2025-2776?
Upgrade SysAid On-Prem to version 24.4.60 or later. As interim mitigations, disable XML external entity processing, restrict network access to SysAid, and rotate all credentials accessible from the server. CISA mandates remediation by August 12, 2025.
How severe is CVE-2025-2776?
CVE-2025-2776 is rated Critical with a CVSS v3.1 score of 9.3. It allows unauthenticated remote exploitation leading to administrator account takeover and arbitrary file reading. At the 98th EPSS percentile, it is among the most actively targeted vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.