EXPOSURES › CVE-2025-2776
CVE-2025-2776
HIGH ⌖ ON CISA KEV · EXPLOITEDSysAid On-Prem suffered XML entity reference vulnerability leading to admin takeover and file reads
SysAid On-Prem, a server-side application, had a critical flaw in its URL processing that allowed for unauthorized access to administrative accounts and file operations. This was actively exploited in the wild, posing a severe threat to DIB organizations' security and data integrity.
Shame score — Active exploitation in the wild and potential for severe unauthorized actions by attackers.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.