CRITICAL · CVSS 9.3 CISA Known Exploited Vulnerability

CVE-2025-2776

Q: Is CVE-2025-2776 being exploited by ransomware groups?

No ransomware group in this database is currently recorded as exploiting CVE-2025-2776.

Q: What does CVE-2025-2776 affect?

CVE-2025-2776 affects SysAid On-Prem. SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Q: How severe is CVE-2025-2776?

CVE-2025-2776 is rated CRITICAL with a CVSS base score of 9.3. EPSS puts the probability of exploitation in the next 30 days at 65.2%, higher than 99.3% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 12 August 2025.

Q: How should organisations respond to CVE-2025-2776?

Apply the vendor patch for SysAid On-Prem as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.

SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability

SysAid On-Prem

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

CVSS

9.3

CRITICAL

EPSS

65.2%

30-day exploitation

Ransomware groups

recorded exploiting

Published

7 May 2025

CWE-611

Exploitation status

CISA Known Exploited Vulnerabilities

Listed by CISA on 22 July 2025. US federal agencies were required to remediate it by 12 August 2025.

EPSS — exploitation probability

FIRST puts the probability of exploitation activity in the next 30 days at 65.2%, which is higher than 99.3% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Frequently asked questions

Is CVE-2025-2776 being exploited by ransomware groups?

No ransomware group in this database is currently recorded as exploiting CVE-2025-2776.

What does CVE-2025-2776 affect?

CVE-2025-2776 affects SysAid On-Prem. SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

How severe is CVE-2025-2776?

CVE-2025-2776 is rated CRITICAL with a CVSS base score of 9.3. EPSS puts the probability of exploitation in the next 30 days at 65.2%, higher than 99.3% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 12 August 2025.

How should organisations respond to CVE-2025-2776?

Apply the vendor patch for SysAid On-Prem as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.