CISA Warns: SysAid Flaws Under Active Attack Enable Remote File Access and SSRF

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included two vulnerabilities in SysAid IT support software in its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. Notably, CVE-2025-2775, which has a CVSS score of 9.3, relates to an improper restriction of XML external entity (XXE) reference vulnerability.

Want More Context? 🔎