What is the CVSS score of CVE-2025-2776?

CVE-2025-2776 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 62.6%.

Is there a public PoC exploit available for CVE-2025-2776?

Yes, a public proof-of-concept exploit is available for CVE-2025-2776. Prioritise patching immediately. EPSS: 62.6%.

How to fix or mitigate CVE-2025-2776?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Sysaid CVE-2025-2776

Q: Which versions of Sysaid are affected by CVE-2025-2776?

CVE-2025-2776 presents critical security risk, a XML external entity vulnerability rated CVSS 9.3.

CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2025-05-07 disclosure@vulncheck.com

XXE Sysaid

9.3

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-611 OWASP Top 10:2025 A02:2025 - Security Misconfiguration ASVS 5.0 V13 - Configuration XML external entity prevention MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Critical risk (CVSS 9.3, EPSS 62.6%). Two independent XXE vectors indicate systemic XML parsing security issues in SysAid.
Exploit ScenarioDerived	If the Checkin XXE is patched, attackers can use the Server URL XXE to achieve the same file reading and credential extraction.

Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.

Exploited in the wild (CISA KEV) No patch listed yet 62.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

SysAid On-Prem contains a second unauthenticated XXE injection in Server URL processing, providing an alternative attack path to the Checkin XXE (CVE-2025-2775) for admin takeover.

Earlier versions of this analysis (1)

v1 Mar 28, 2026 - 18:40 CVSS 9.3

A second XXE injection in SysAid's Server URL processing provides an alternative unauthenticated file reading path alongside CVE-2025-2775.

RemediationAI

Apply SysAid updates addressing both XXE vulnerabilities. Implement comprehensive XML parsing hardening.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The CWE-611 XXE in Server URL XML processing provides a second exploitation vector for file reading and admin account compromise.

Know when Sysaid gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Added to CISA KEV

Oct 27, 2025 - 16:58 cisa

CISA KEV

PoC Detected

Oct 27, 2025 - 16:58 vuln.today

Public exploit code

CVE Published

May 07, 2025 - 15:15 nvd

CRITICAL 9.3

DescriptionCVE.org

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Executive ViewAI

Why It Matters

CVE-2025-2776 presents critical security risk, a XML external entity vulnerability rated CVSS 9.3. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

Threat Score

6.7/10

Composite threat intelligence

EPSS Score

62.6%

Top 2% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

CISA KEV

EPSS POC (1)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 62.6%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + in CISA KEV (actively exploited), no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

179

Low Medium High Critical

KEV: +50

EPSS: +63

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

XML External Entity Injection HIGH

XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.

Affected Products (CPE)CVE.org

cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:*

More in Sysaid

View all

CVE-2023-47246 CRITICAL Emergency POC

9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f

CVE-2025-2775 CRITICAL Emergency POC

9.3 May 07

SysAid On-Prem versions through 23.3.40 contain an unauthenticated XXE injection in the Checkin processing, enabling adm

CVE-2015-2996 HIGH Act Now POC

8.5 Jun 08

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrar

CVE-2015-2995 MEDIUM This Month POC

6.8 Jun 08

The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote at

CVE-2015-2994 MEDIUM This Month POC

6.5 Jun 08

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators t

CVE-2015-2993 HIGH Act Now POC

7.5 Jun 08

SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers t

CVE-2015-2997 MEDIUM This Month POC

5.0 Jun 08

SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the account

CVE-2015-2998 MEDIUM This Month POC

5.0 Jun 08

SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensi

CVE-2025-2777 CRITICAL Emergency POC

9.3 May 07

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the l

CVE-2015-3000 HIGH Act Now POC

7.8 Jun 08

SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a lar

CVE-2020-10569 CRITICAL Act Now POC

9.8 Apr 21

SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Rated cri

CVE-2021-30486 HIGH This Week POC

8.8 Jul 22

SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetMa

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all

CVE-2019-9670 CRITICAL POC

9.8

CVE-2025-58360 CRITICAL POC

9.8

CVE-2017-12629 CRITICAL POC

9.8

CVE-2016-9563 MEDIUM POC

6.5

CVE-2012-3363 CRITICAL POC

9.1

CVE-2016-4264 HIGH POC

8.6

CVE-2025-11700 HIGH POC

8.4

Same technique XXE

View all

CVE-2013-5014 HIGH POC

7.5

CVE-2015-0923 MEDIUM POC

5.0

CVE-2014-0644 HIGH POC

7.8

CVE-2013-6397 MEDIUM POC

4.3

References

Advisories & patches

REF https://documentation.sysaid.com/docs/24-40-60 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back