SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
https://documentation.sysaid.com/docs/24-40-60
https://securityaffairs.com/180293/hacking/u-s-cisa-adds-crushftp-google-chromium-and-sysaid-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://www.securityweek.com/cisa-warns-of-sysaid-vulnerability-exploitation/
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-sysaid-vulnerabilities-in-attacks/
https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog
https://thehackernews.com/2025/07/cisa-warns-sysaid-flaws-under-active.html
https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
Source: Mitre, NVD
Published: 2025-05-07
Updated: 2025-07-23
Known Exploited Vulnerability (KEV)
Base Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
Severity: High
Base Score: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.55876