CVE-2025-2776: SysAid On-Prem unauthenticated XXE in Server URL processing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable XXE with CVSS 9.8, active KEV listing, high EPSS, and a public exploit write-up make this an urgent patch.

What it is

SysAid On-Prem versions up to 23.3.40 process the Server URL without restricting XML external entities, so an unauthenticated attacker can supply crafted XML that the server resolves. This XXE yields file read primitives and enables administrator account takeover, making it a full compromise of the application.

Impact

An attacker gains arbitrary file read on the server and can take over an administrator account, leading to control of the SysAid instance and its data.

Attack surface

Reachable over the network through the Server URL processing functionality with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

CISA added it to KEV on 2025-07-22 with a remediation due date of 2025-08-12, and EPSS gives a 30-day probability of 0.644 (99.2nd percentile); a public exploit write-up is referenced by WatchTowr.

What to do

• Upgrade SysAid On-Prem to a fixed release per the vendor release notes (24.40.60 documentation) and verify the build after patching.
• If patching cannot be completed by the KEV due date, apply vendor-supplied mitigations or discontinue use of the product as directed by CISA.
• Restrict network access to the SysAid server so only trusted management networks can reach it.
• Disable external entity resolution in the XML parser configuration where the product allows it.
• Rotate administrator credentials and review admin accounts for unauthorized changes.

Detection

• Search SysAid server logs for XML requests to Server URL endpoints containing DOCTYPE or ENTITY declarations.
• Monitor for outbound connections from the SysAid host to unexpected external hosts or file-share protocols.
• Alert on new or modified administrator accounts and unusual admin logins in SysAid audit logs.
• Hunt for reads of sensitive local files (for example configuration or credential files) by the SysAid service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.