CVE-2025-2775: SysAid On-Prem unauthenticated XXE, chains to admin takeover
The short version: SysAid On-Premise has an unauthenticated XML External Entity (XXE) flaw (CVE-2025-2775) in its Check-in processing that gives an attacker a file-read primitive and, chained with follow-on steps, administrator account takeover. It's listed in CISA's KEV catalog and a fix exists. If you run SysAid on-prem, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Low — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (VulnCheck, CNA) | 9.3 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
| EPSS | ~54.6% · 98.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-08-12 |
| Known exploited? | Yes — added to KEV; part of a documented exploit chain |
| Vulnerability type | CWE-611 XML External Entity → file read → administrator account takeover |
| Requires authenticated session? | No — pre-authentication |
| Affected | SysAid On-Prem 23.3.40 and earlier |
| Fixed in | A patched release above 23.3.40 (upgrade to the current supported build) |
What you need to know
CVE-2025-2775 is an XXE in the Check-in processing of on-premises SysAid. Because the server parses attacker-supplied XML without safely disabling external entities, an unauthenticated attacker can read files from the host and reach internal resources — and researchers demonstrated chaining it to administrator account takeover, which opens the door to full compromise.
Two things make this outrun a plain "file read" bug:
- It's pre-authentication. No account needed — just a crafted request to the Check-in endpoint.
- It chains. File read plus admin takeover is why the practical impact, and the CNA's 9.3 score, land above NVD's 7.5.
How serious we see it
Low — in practice, above the NVD base score.
NVD scores the raw file-read at 7.5; the vendor-adjacent CNA scores it 9.3 because the real risk is the chain to administrator takeover. We rate it by what it does: an unauthenticated path to admin control of an internal-facing operations platform that's already in KEV. The bounded, reassuring part is that it's specific and fixed — on-prem SysAid at or below 23.3.40, with a patched build available and exposure quick to confirm.
Recommendations
Straight from SysAid's guidance and CISA:
- Patch now. Upgrade SysAid On-Prem past 23.3.40 to the current supported release.
- Hunt for prior use. Review logs for anomalous Check-in requests and unexpected administrator activity.
- If compromised, respond. Rotate administrator credentials and secrets, and investigate for lateral movement.
- Restrict exposure. Keep SysAid off the open internet where possible.
- Confirm your exposure first. Verify whether you run on-prem SysAid and which build.
How BreachRisk sees it
BreachRisk discovers internet-facing SysAid instances from the outside, fingerprints the version, and flags exposure tied to this KEV-listed CVE so it rises to the top of your results. Safe verification isn't offered here — a reliable confirmation would require intrusive, multi-step interaction — so BreachRisk detects and prioritizes the exposure rather than exploiting it. The value is that an exposed, affected SysAid is already on your map the moment the flaw matters.