Quick Takeaways
-
Vulnerabilities Identified: CISA added two recently patched SysAid On-Prem vulnerabilities (CVE-2025-2776 and CVE-2025-2775) to its Known Exploited Vulnerabilities catalog, discovered as XXE issues.
-
Patching Timeline: These vulnerabilities were patched in March 2025 during the release of SysAid version 24.4.60, after being disclosed by WatchTowr, highlighting potential risks for unauthenticated remote command execution.
-
Limited Exposure: Although SysAid serves 10 million users globally, only 77 vulnerable instances were identified by the Shadowserver Foundation as exposed to the internet at the time of disclosure.
- Potential Exploitation Concerns: Despite no public reports of exploitation for the newly added CVEs, past incidents show that ransomware groups have historically exploited SysAid vulnerabilities, raising concerns about future threats.
Key Challenge
On Tuesday, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog to include two recently patched security flaws in SysAid’s IT service management software, designated as CVE-2025-2776 and CVE-2025-2775. These vulnerabilities, identified as XML External Entity (XXE) issues, were uncovered in December 2024 by the cybersecurity firm WatchTowr, which disclosed specifics and Proof of Concept (PoC) exploit code in May 2025. Notably, WatchTowr cautioned that these vulnerabilities could potentially be exploited in conjunction with a previously discovered OS command injection flaw (CVE-2024-36394), enabling malicious actors to execute commands remotely without authentication. While SysAid’s products are utilized by over 10 million users globally, only a small fraction (77 instances) were publicly identified as vulnerable at the time of disclosure.
Despite the potential severity of these vulnerabilities, there are currently no known incidents of exploitation targeting CVE-2025-2776 and CVE-2025-2775, as noted in CISA’s advisory, which specifically states that these flaws have not yet been implicated in ransomware attacks. However, the historical context reveals that the exploitation of SysAid vulnerabilities is not without precedent; for example, in 2023, Cl0p ransomware affiliates successfully exploited a different zero-day vulnerability. As this situation evolves, SecurityWeek is actively seeking responses from both WatchTowr and SysAid for further clarification on the matter.
What’s at Stake?
The recent identification of vulnerabilities CVE-2025-2776 and CVE-2025-2775 in SysAid’s IT service management software, now categorized by CISA as Known Exploited Vulnerabilities, poses significant risks not only to the immediate users of the software but also to a broader network of organizations reliant on similar technologies. Given that SysAid serves around 10 million users globally, even a seemingly limited number of exposed instances could catalyze widespread repercussions, particularly if these vulnerabilities are exploited in conjunction with related flaws like CVE-2024-36394, which facilitates unauthenticated remote command execution. The potential for these exploited vulnerabilities to be weaponized by ransomware groups, as indicated by historical exploits of related software, highlights a chilling prospect for all businesses leveraging ITSM products. A successful attack could lead to data breaches, operational disruptions, and a cascade of financial and reputational damage that extends beyond the initial target, underscoring the imperative for all organizations to diligently monitor and mitigate such vulnerabilities in their own infrastructures.
Possible Action Plan
Timely remediation is essential in the landscape of cybersecurity, especially in response to vulnerabilities like the one identified by CISA in SysAid. The potential consequences of exploitation underscore the need for swift action.
Mitigation Steps
- Immediate Patching: Apply security updates to remediate the vulnerability.
- Access Controls: Review and restrict user permissions associated with SysAid.
- Network Segmentation: Isolate affected systems to minimize exposure.
- Monitoring: Enhance system monitoring for suspicious activity related to SysAid.
- Incident Response: Prepare an incident response plan in case exploitation is detected.
NIST CSF Guidance
NIST CSF emphasizes the criticality of an adaptive cybersecurity posture. For enhanced context regarding vulnerability management, refer to NIST SP 800-53, particularly the controls related to vulnerability assessment and mitigation strategies.
Advance Your Cyber Knowledge
Stay informed on the latest Threat Intelligence and Cyberattacks.
Understand foundational security frameworks via NIST CSF on Wikipedia.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
