CVE-2025-2776

CriticalPublished

SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

Published: May 7, 2025
Updated: Nov 19, 2025
Assigning CNA: VulnCheck
Evidence observed: Jul 22, 2025

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

64.7%

High · next 30 days

Percentile: 99.2%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

SysAid On-Prem <= 23.3.40 - XML External EntityTemplate
http/cves/2025/CVE-2025-2776.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: word($.matchers[*].type)
- oob: interactsh_reference($.template_text)

watchTowr-vs-SysAid-PreAuth-RCE-ChainExploit
PoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)
From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.