SysAid On-Prem - XXE (CVE-2025-2776)

CVE-2025-2776 is a significant vulnerability in SysAid On-Prem that allows unauthenticated attackers to exploit XML External Entity (XXE) flaws within the Server URL processing functionality. Successful exploitation may lead to administrator account takeover or unauthorized file retrieval from the system.

CrowdSec has been tracking this vulnerability and its exploits since 1st of June 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-2776 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-2776 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-2776 is currently experiencing high visibility and active exploitation across the internet.

Threat actors are primarily targeting URLs containing /mdm/serverurl as part of their exploitation attempts.