CISA Warns: SysAid Flaws Under Active Attack Enable Remote File Access and SSRF

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

SysAid On-Prem, an IT service management (ITSM) platform, is vulnerable to an unauthenticated XML External Entity (XXE) flaw (CWE-611) in its Server URL processing functionality. Because the XML parser accepts attacker-controlled external entities without restriction, any remote attacker who can reach the vulnerable endpoint can trigger the flaw with no credentials and no user interaction. Successful exploitation gives the attacker arbitrary file-read primitives on the server, which can be leveraged to hijack an administrator account; public research (watchTowr) demonstrates chaining this XXE into pre-auth remote code execution, and related reporting notes SSRF and remote file access in active attacks. All SysAid On-Prem deployments running version 23.3.40 or earlier are affected. Exploitation is ongoing: CISA added CVE-2025-2776 to the Known Exploited Vulnerabilities catalog on 2025-07-22, and EPSS assigns a 64.4% probability of exploitation within 30 days.

Do: Upgrade all SysAid On-Prem installations to a release newer than 23.3.40 per the vendor's patched advisory, applying the other recently patched SysAid fixes as well since the public PoC chains this XXE with additional flaws into pre-auth RCE. Until patched, limit internet exposure of the SysAid server and check logs for XXE/SSRF activity and unexpected administrator logins. CISA's BOD 22-01 directive requires federal agencies to apply vendor mitigations or discontinue use of the product; the PoC is public and exploitation is confirmed, so treat this as urgent.

SysAid On-Prem versions 23.3.40 and earlier contain an unauthenticated XML External Entity (XXE) injection flaw (CWE-611) in the functionality that processes lshw (hardware inventory) data. Because the XML parser resolves external entities from network-supplied input without requiring authentication, a remote attacker can inject malicious entity definitions into lshw processing requests. Successful exploitation yields arbitrary file-read primitives and can be leveraged to take over an administrator account (CVSS 3.1: 9.8). All organizations running affected on-premises SysAid builds are in scope; cloud-hosted SysAid is not named in the advisory. Exploitation is likely in the wild: CISA has warned that SysAid flaws enabling remote file access and SSRF are under active attack, a public PoC has been released, and EPSS puts the 30-day exploitation probability at 72.2%.

Do: Upgrade SysAid On-Prem to a patched release newer than 23.3.40 as soon as possible (the vendor has patched this and related pre-auth flaws, per recent headlines). Until patched, minimize the server's internet exposure and restrict its outbound network access, since XXE exploitation can depend on the server resolving attacker-controlled external entities. Review logs for unexpected unauthenticated lshw/XML requests and for signs of administrator account changes or unusual file access.