CVE-2025-2775
Exploited in the Wild
✓ Confirmed 0-Day
Triaged: March 20, 2026
3 articles
Published: 2025-05-07
EPSS Score
Source: FIRST.org · 2026-05-24
69.27%
probability
This CVE has a 69.27% probability
of being exploited in the next 30 days.
0%
Top 98.7th percentile of all CVEs
100%
CVSS v3.1
Source: VulnerabilityLookup (CIRCL)9.3
CRITICAL
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Description
VulnerabilityLookup (CNA)SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.
Affected Products
SysAid
SysAid On-Prem
0
Attack Intelligence
Exploits & PoC
watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain
PoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)
12
1 repo — triés par ⭐
Rechercher sur GitHub ↗
Signal Intelligence
Confidence
85%
EPSS
69.27%
CVSS v3.1
9.3
Mentions
3
CNA Information
CNA Assigner
VulnCheck
CNA Title
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
Analyst Note
CVE-2025-2775 is explicitly listed in CISA's Known Exploited Vulnerabilities catalog with documented active exploitation against SysAid IT support software. The 2025 publication year and CISA KEV inclusion indicate exploitation occurred in or near real-time with patch availability, meeting zero-day criteria.
Threat Actors 5
Hacking Team
apt_group
🇮🇹 IT
Tick
apt_group
Information theft and espionage
🇨🇳 CN
Red Dev 17
apt_group
🇨🇳 CN
Mana Team
apt_group
🇨🇳 CN
Lurk
apt_group
Financial crime
🇷🇺 RU
Triage Info
Decided atMar 20, 2026
Published DateMay 07, 2025