CVE-2025-2775

The vulnerability in question pertains to an unauthenticated XML External Entity (XXE) issue found in specific versions of the SysAid On-Prem software. This flaw arises from improper handling of XML input during the Checkin processing functionality, which allows an attacker to manipulate XML data to access sensitive files or even execute commands on the server. By exploiting this vulnerability, an attacker can potentially read arbitrary files on the server, leading to the exposure of sensitive information, such as configuration files or user credentials. Furthermore, the ability to perform XXE attacks can enable an adversary to escalate privileges, particularly targeting administrator accounts, thereby compromising the entire system.

Attack vectors for this vulnerability are particularly concerning due to the ease with which an attacker can exploit the flaw. An unauthenticated user can craft a malicious XML payload and submit it to the vulnerable endpoint. This payload can include references to external entities, allowing the attacker to read files from the server or even execute remote requests. For instance, an attacker could retrieve sensitive files such as password databases or configuration files, which could then be used to further compromise the system or gain unauthorized access to other connected systems. Additionally, if the attacker successfully gains administrative access, they can manipulate the system settings, install malware, or exfiltrate sensitive data, significantly increasing the potential damage.

The real-world impact of this vulnerability is substantial, particularly for organizations relying on SysAid for IT service management. The risk extends beyond mere data exposure; it encompasses potential operational disruptions, reputational damage, and financial losses. Organizations may face regulatory scrutiny if sensitive data is compromised, leading to legal ramifications and loss of customer trust. The ability for an attacker to take over administrator accounts means that the entire IT infrastructure could be at risk, allowing for further exploitation or lateral movement within the network. This vulnerability not only threatens the integrity of the affected systems but also poses a broader risk to the organization’s overall cybersecurity posture.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-layered security approach. Firstly, regular vulnerability assessments and penetration testing should be conducted to identify and remediate such weaknesses proactively. Employing web application firewalls (WAF) can help filter out malicious XML payloads before they reach the application. Additionally, organizations should ensure that they are using the latest versions of SysAid, as updates often include patches for known vulnerabilities. It is also advisable to implement strict input validation and sanitization practices to prevent the processing of malicious XML data. Furthermore, monitoring and logging access to sensitive files can help detect unusual activity that may indicate exploitation attempts.

In conclusion, the unauthenticated XML External Entity vulnerability in SysAid On-Prem poses significant risks to organizations, allowing attackers to gain unauthorized access and potentially compromise sensitive information. The ease of exploitation and the severe consequences of a successful attack necessitate immediate attention and action from affected organizations. By adopting robust detection and mitigation strategies, businesses can safeguard their systems against this and similar vulnerabilities, thereby enhancing their overall security posture and resilience against cyber threats.

CSURFACE threat intelligence has observed a slight increase in exploitation attempts targeting the CVE-2025-2775 vulnerability in SysAid On-Prem, reflected by a modest uptick in detection activity across our sensors. Despite this, the Exploit Prediction Scoring System (EPSS) score has decreased, indicating a reduced likelihood of widespread exploitation in the immediate term. The emergence of new proof-of-concept exploits consolidates attacker capabilities, underscoring the vulnerability’s persistence as a viable attack vector. This nuanced shift suggests that while adversaries are actively probing and refining exploitation techniques, large-scale campaigns have not yet materialized. Defenders should remain vigilant given the continued presence of active exploitation attempts and the availability of public exploit code, which lowers the barrier for threat actors to weaponize this vulnerability. Overall, the threat level remains high due to the vulnerability’s critical impact potential, but the current exploitation momentum appears to be stabilizing rather than accelerating.

Update 2 — June 22, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-2775, reflected by a notable surge in telemetry signals from our sensors. This increase indicates that threat actors are intensifying their probing and exploitation efforts against vulnerable SysAid On-Prem installations. The presence of a recently published proof-of-concept exploit chain combining multiple related CVEs has likely lowered the technical barrier for adversaries, facilitating more frequent and sophisticated attack attempts. Although the EPSS score shows a slight decline in short-term trend, the overall exploitability remains high given the critical impact of administrator account takeover and file disclosure capabilities. This evolving activity underscores the vulnerability’s sustained attractiveness to attackers and suggests that opportunistic exploitation could soon escalate into more widespread campaigns. Defenders should consider this development a clear signal of heightened risk, as the expanded exploitation footprint increases the likelihood of successful compromises in unpatched environments.

Update 3 — July 09, 2026

CSURFACE threat intelligence has detected a modest increase in exploitation attempts targeting CVE-2025-2775, reflecting a slight upward trend in attacker interest despite a marginal decline in the EPSS score. This subtle rise in activity, coupled with the recent inclusion of the vulnerability in the KEV catalog, signals sustained adversary focus on leveraging the unauthenticated XML External Entity flaw to achieve administrator account takeover and sensitive file access. Additionally, the emergence of new proof-of-concept exploit chains that combine multiple related CVEs underscores the growing sophistication of attack methods. While the short-term exploitability metric shows a minor decrease, the overall risk remains elevated due to the critical impact and expanding exploitation footprint. Defenders should interpret this development as an indication that exploitation attempts are persistent and may intensify, increasing the likelihood of successful intrusions in environments lacking timely patching.