CVE-2025-2775: SysAid On-Prem unauthenticated XXE in Checkin processing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable XXE leading to admin takeover, with KEV listing, high EPSS, and a public exploit reference.

What it is

SysAid On-Prem versions up to 23.3.40 process Checkin XML without restricting external entities, so an unauthenticated attacker can supply a crafted document that resolves external entities. The flaw enables administrator account takeover and arbitrary file read, making it a serious pre-auth issue for internet-facing help desk deployments.

Impact

An attacker can read files from the server and take over an administrator account, which in practice opens the door to full control of the SysAid instance and its data.

Attack surface

Reachable over the network through the Checkin processing functionality; the CVSS vector shows no privileges and no user interaction required, so it is exploitable pre-authentication.

Exploitation

CVE-2025-2775 is listed in CISA KEV with a 2025-08-12 remediation due date, and EPSS gives roughly 43 percent 30-day probability at the 98.6th percentile; a public exploit write-up is referenced. No ransomware campaign use is documented.

What to do

• Upgrade SysAid On-Prem to a fixed release per the vendor release notes (24.40.60 documentation) and verify the Checkin endpoint is patched.
• If patching cannot be completed by the KEV due date, restrict network access to the Checkin functionality and the SysAid web interface to trusted sources only.
• Disable or block external entity resolution in the XML parser handling Checkin requests where configuration allows.
• Rotate administrator credentials and review admin accounts for unauthorized changes after any suspected exposure.
• Follow BOD 22-01 guidance or discontinue use of the product if mitigations are unavailable.

Detection

• Inspect Checkin request bodies and web logs for XML containing DOCTYPE declarations, ENTITY definitions, or SYSTEM/PUBLIC identifiers.
• Alert on outbound connections from the SysAid server to unexpected hosts, which may indicate entity-based data exfiltration.
• Monitor for anomalous administrator logins, new admin accounts, or configuration changes on the SysAid instance.
• Review file access patterns on the SysAid host for reads of sensitive files outside normal application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.