Severe Exploit Chain Uncovered in SysAid’s On-Premise ITSM Platform Enables Stealthy Remote Access
Security researchers have exposed a high-impact exploit chain within SysAid’s self-hosted IT Service Management (ITSM) platform, which enables remote code execution (RCE) prior to authentication—no credentials required.
At the heart of the issue lies a blend of multiple XML External Entity (XXE) injection points and a critical operating system (OS) command execution flaw. When combined, these weaknesses form a potent attack path capable of breaching enterprise environments that rely on SysAid.
Three unique CVEs—CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777—have been assigned to the XXE bugs, which reside in SysAid’s Mobile Device Management (MDM) interface and the hardware inventory component. These entry points can be manipulated to leak arbitrary files from the backend system.
What makes this particularly alarming is the presence of a plaintext admin credential file—InitAccount.cmd—which remains on disk even after setup is complete. According to researchers at watchTowr Labs, this file can be retrieved using the XXE vulnerabilities, handing attackers full admin privileges.
“The ability to pull cleartext credentials from the filesystem using unauthenticated XXE requests escalated this from a misconfiguration to a full compromise scenario,” the researchers told Cyber Security News.
Attack Flow Breakdown:
- Exploiting XXE flaws through MDM and inventory endpoints.
- Exfiltrating sensitive server-side files (e.g., config scripts, password dumps).
- Leveraging command injection to execute arbitrary OS-level commands.
This vulnerability chain represents a significant threat to organizations running on-premise SysAid instances and underlines the critical importance of secure configuration and patching practices.
Unsecured Setup Artifact Opens Door to Full Compromise in SysAid ITSM
Security analysts have uncovered a dangerous oversight in SysAid’s installation process: a script named InitAccount.cmd, quietly left on the server after setup, contains unencrypted administrator credentials. This seemingly minor lapse becomes a major security risk when paired with the platform’s exploitable XXE flaws.
Threat actors don’t need to be logged in to take advantage. By manipulating the vulnerable XML parsers, attackers can extract this credentials file directly from the server, handing them full administrative control over the application.
Armed with admin rights, an attacker’s next move is even more damaging. The researchers demonstrated that a separate flaw—CVE-2025-2778—lurks in the API.jsp endpoint. This post-authentication vulnerability allows remote command execution by injecting malicious input into the javaLocation parameter, which is dangerously passed into system-level shell commands without proper sanitization.
Together, these issues form a tightly linked attack chain that moves from unauthenticated file access to full system compromise, using leftover install scripts and insecure scripting practices as stepping stones.
Business-Critical ITSM Systems at Risk: SysAid Exploits Highlight the Urgency of Proactive Defense
The latest exploit chain in SysAid’s on-premise ITSM suite hits where it hurts most: at the heart of enterprise operations. Housing everything from incident logs to asset inventories, SysAid isn’t just another back-office tool—it’s a central nervous system for IT departments. When compromised, the ripple effect can be both wide and costly.
Who’s Affected?
Any organization still running SysAid On-Premise version 23.3.40 or earlier is exposed to these newly disclosed vulnerabilities. The fix? Version 24.4.60, shipped in March 2025, includes patches for the entire vulnerability chain. Updating isn’t optional—it’s urgent.
Context Matters:
This is not SysAid’s first brush with high-severity flaws. In late 2023, a zero-day vulnerability (CVE-2023-47246) was actively exploited by the threat group Lace Tempest (also tracked as DEV-0950), who weaponized the flaw to deploy malicious WAR files and gain unauthorized access.
This latest wave of vulnerabilities shows a clear pattern: attackers are targeting ITSM platforms not just for the systems they control, but for the sensitive data they contain. Ransomware operators, in particular, see gold mines in platforms like SysAid, where tickets often reveal system configurations, incident response plans, and internal communications.
Immediate Steps for SysAid Users:
- Upgrade to version 24.4.60 or newer without delay.
- Run a deep-dive security audit to detect potential signs of compromise.
- Scrutinize system and application logs for anomalous activity tied to exposed endpoints.
- Lock down network exposure by placing SysAid instances behind strong access controls and segmentation.
Bigger Picture:
Software with vast administrative reach—like SysAid—is inherently high-risk. As threat actors grow more capable and targeted, every overlooked script, misconfigured endpoint, or unpatched flaw becomes a potential foothold. Organizations must move beyond reactive patching and embrace continuous, risk-based security reviews to stay ahead of the next breach.
