AdvisoryhighExploited in the wild

CISA Warns: SysAid Flaws Under Active Attack Enable Remote File Access and SSRF

The Hacker Newsby @TheHackersNewsJul 23, 2025 · 06:24 UTC (Jul 23, 2025)1 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-2775 CVE-2025-2776 CVE-2025-2777 CVE-2024-36394

Tags: cve-2025-2775 cve-2025-2776 cve-2025-2777 cve-2024-36394 advisory

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-36394	SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	9.8	1%		Jun 6, 2024
CVE-2025-2776 +1 related CVE CVE-2025-2775	Unauthenticated XXE in SysAid On-Prem Enables Admin Account Takeover	9.8 group max	65%	KEVPoC	May 7, 2025 KEV Jul 22, 2025
CVE-2025-2777	Unauthenticated XXE in SysAid On-Prem <= 23.3.40 Enables Admin Takeover	9.8	73%	PoC	May 7, 2025

From the original article

1 min read at thehackernews.com

 Ravie Lakshmanan  Jul 23, 2025 Vulnerability / Software Security The U. S. Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws impacting SysAid IT support software to its Known Exploited Vulnerabilities ( KEV ) catalog, based on evidence of active exploitation.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.