CVE-2025-2776

9.8 criticalKEVEPSS 65%

Critical (9.8) in SysAid SysAid On-Prem. In CISA KEV since 2025-07-22. EPSS 65% chance of exploitation in the next 30 days.

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 65% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2025-07-22, due 2025-08-12
CWE: CWE-611
Published: 2025-05-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sysaid:sysaid

References

https://documentation.sysaid.com/docs/24-40-60
https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776

Check your stack JSON