SysAid On-Prem - XXE (CVE-2025-2775)

CVE-2025-2775 is a serious vulnerability in SysAid On-Prem that exposes systems to unauthenticated XML External Entity (XXE) attacks during check-in processing, potentially enabling attackers to read arbitrary files or take over administrator accounts.

CrowdSec has been tracking this vulnerability and its exploits since 1st of June 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2025-2775 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-2775 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-2775 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts are characterized by requests to URLs containing /mdm/checkin.