CVE-2025-2776

SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

State: Published
Severity: 9.3 Critical
Published: May 7, 2025
Updated: Nov 19, 2025
Reserved: Mar 24, 2025

Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L	VulnCheck

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
SysAid On-PremSysAid	23.3.40 and earlierAffected

References

https://documentation.sysaid.com/docs/24-40-60vendor-advisory
https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.