SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 7, 2025 · Catalog

   Detected

   SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

2. Jul 22, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Aug 12, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

Affected

• cpe sysaid/sysaidversion unspecified
• vendor SysAid SysAid On-Premversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2025-2775

  SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

  cisa.gov
• CVE.orgVulnerability recordCVE-2025-2775

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-2775

  30-day exploitation probability 42.6%

  first.org
• NIST NVDVulnerability recordCVE-2025-2775

  SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

  nvd.nist.gov

References

• CISA note · documentation.sysaid.com
• Exploit · labs.watchtowr.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov