PatchTheCVE: sysaidhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-2777: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerabilithttps://patchthecve.com/cve/CVE-2025-2777.htmlhttps://patchthecve.com/cve/CVE-2025-2777.htmlWed, 17 Jun 2026 09:07:36 +0000CRITICAL 9.3: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.CVE-2025-2776: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerabilityhttps://patchthecve.com/cve/CVE-2025-2776.htmlhttps://patchthecve.com/cve/CVE-2025-2776.htmlWed, 17 Jun 2026 09:07:36 +0000CRITICAL 9.3: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.CVE-2025-2775: SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerabilityhttps://patchthecve.com/cve/CVE-2025-2775.htmlhttps://patchthecve.com/cve/CVE-2025-2775.htmlWed, 17 Jun 2026 09:07:36 +0000CRITICAL 9.3: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.