SysAid · SysAid On-Prem

CVE-2025-2775

SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

Exploited in attacks Critical 9.3 Attack chance: 43%

What it is

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

CISA: SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: August 12, 2025

documentation.sysaid.com/docs/24-40-60

Added to the CISA list: July 22, 2025
Published: May 7, 2025
Severity: Critical 9.3 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 43% in the top 1.3% of all known vulnerabilities
Weakness: CWE-611
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from SysAid

Added	Vulnerability	Product	Severity	Attack chance
Jul 22, 2025	On-Prem Improper Restriction of XML External Entity ReferenceCVE-2025-2776	SysAid On-Prem	Critical 9.3	65%
Nov 13, 2023	Server Path TraversalCVE-2023-47246used by ransomware	SysAid Server	Critical 9.8	99%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.