PT-2025-20134 · Sysaid · Sysaid On-Prem

Jake Knott + 2 · Published 2025-01-06 · Updated 2026-01-22 · CVE-2025-2776

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier

Description SysAid On-Prem is affected by an unauthenticated XML External Entity (XXE) issue in the Server URL processing functionality. This allows for administrator account takeover and file read operations. The issue is due to improper restriction of XML external entity references. Reports indicate active exploitation of this issue.

Recommendations Versions prior to 23.3.40 should be updated.

Exploit

Fix

RCE

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-06578

CVE-2025-2776

Affected Products

Sysaid On-Prem

References · 70

• 🔥 https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket · Exploit
• https://bdu.fstec.ru/vul/2025-06578 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2776 · Security Note
• https://twitter.com/Phill_CTH/status/1964214840618004930 · Twitter Post
• https://twitter.com/Phill_CTH/status/1954726309411852443 · Twitter Post
• https://twitter.com/Phill_CTH/status/1961434293390979412 · Twitter Post
• https://i.redd.it/526p5m70yxeg1.png · Reddit Post
• https://twitter.com/CveFindCom/status/1920132584773742687 · Twitter Post
• https://twitter.com/Phill_CTH/status/1962609910643859705 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1m9tkdx/top_10_trending_cves_26072025 · Reddit Post
• https://twitter.com/fofabot/status/1948281562354913382 · Twitter Post
• https://twitter.com/dCypherIO/status/1948473261588635878 · Twitter Post
• https://twitter.com/ScyScan/status/1947779496712802787 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1m7hopf/cisa_alerts_on_active_exploitation_of_sysaid · Reddit Post