SysAid incident on October 29, 2026: We are currently investigating this incident. Started 4:30 PM UTC, resolved ongoing (● 5m). Affected: SysAid North America (INST06US - N. Virginia).

SysAid incident on October 7, 2026: Our team is currently investigating a service disruption / performance degradation. We’re working to identify the root cause of this issue a Started 9:58 PM UTC, resolved ongoing (● 7m). Affected: SysAid North America (INST05US - N. Virginia).

Compare Jira Service Management, Freshservice, ManageEngine ServiceDesk Plus, HaloITSM, SysAid, TOPdesk, ServiceNow and Ivanti on 2026 published pricing, free plans and ITIL scope.

CISA has added two recent SysAid flaws, CVE-2025-2776 and CVE-2025-2775, to its Known Exploited Vulnerabilities (KEV) catalog.

SysAid patches IT service management software vulnerabilities that can be chained for unauthenticated remote command execution.

Urgent: Unpatched SysAid On-Premises systems vulnerable to remote code execution. Update now! #SysAid #RCE #Cybersecurity

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

SysAid fixed 4 critical pre-auth flaws in March 2025; chained bugs allow full admin access and RCE.

A Russian digital extortion gang behind a raft of attacks on file transfer applications is now targeting a newly patched vulnerability in SysAid IT support

 The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert about two high-risk vulnerabilities in SysAid’s IT service management (ITSM) platform that are being actively exploited by attackers. These security flaws, identified as CVE-2025-2775 and CVE-2025-2776, can enable unauthorized actors to hijack administrator accounts without requiring credentials.  Discovered in December 2024 by researchers at watchTowr Labs, the two vulnerabilities stem from XML External Entity (XXE) injection issues. SysAid addressed these weaknesses in March 2025 through version 24.4.60 of its On-Premises software. However, the urgency escalated when proof-of-concept code demonstrating how to exploit the flaws was published just a month later, highlighting how easily bad actors could access sensitive files on affected systems.  Although CISA has not provided technical specifics about the ongoing attacks, it added the vulnerabilities to its Known Exploited Vulnerabilities Catalog. Under Binding Operational Directive 22-01, all Federal Civilian Executive Branch (FCEB) agencies are required to patch their systems by August 12. CISA also strongly recommends that organizations in the private sector act swiftly to apply the necessary updates, regardless of the directive’s federal scope.  “These vulnerabilities are commonly exploited by malicious cyber actors and present serious threats to government systems,” CISA stated in its warning. SysAid’s On-Prem solution is deployed on an organization’s internal infrastructure, allowing IT departments to manage help desk tickets, assets, and other services. According to monitoring from Shadowserver, several dozen SysAid installations remain accessible online, particularly in North America and Europe, potentially increasing exposure to these attacks.  Although CISA has not linked these specific flaws to ransomware campaigns, the SysAid platform was previously exploited in 2023 by the FIN11 cybercrime group, which used another vulnerability (CVE-2023-47246) to distribute Clop ransomware in zero-day attacks. Responding to the alert, SysAid reaffirmed its commitment to cybersecurity. “We’ve taken swift action to resolve these vulnerabilities through security patches and shared the relevant information with CISA,” a company spokesperson said. “We urge all customers to ensure their systems are fully up to date.”  SysAid serves a global clientele of over 5,000 organizations and 10 million users across 140 countries. Its user base spans from startups to major enterprises, including recognized brands like Coca-Cola, IKEA, Honda, Xerox, Michelin, and Motorola.

SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read pri...

SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primit...

Threat actors are exploiting a zero-day vulnerability in the service management software SysAid to gain access to corporate servers for data theft and to deploy Clop ransomware.

An Iran-linked APT tracked as Cavern Manticore is targeting organizations in Israel with a modular C&C framework that uses .NET compilation formats as an anti-analysis layer. The group, likely tied to Iran’s MOIS and possibly the OilRig subgroup Lyceum, abuses SysAid updates, RMM tools, and remote desktop features to move laterally...

Check Point Research tracked Cavern Manticore, an Iran-nexus threat actor targeting Israeli government and IT organizations using a modular .NET C2 framework with strong anti-analysis features and RMM abuse for initial access. The report also details related infrastructure, legacy Cav3rn samples, and multiple post-exploitation modules for reconnaissance, file access, LDAP, SQL, networking, and tunneling. #CavernManticore #MuddyWater #Lyceum #SysAid #uxtheme.dll #n-HTCommp.dll

An Iranian hacking group linked to MOIS has been using the modular Cavern (Cav3rn) C2 framework to target Israeli organizations, especially IT providers and government sectors. The campaign uses trojanized SysAid updates, DLL side-loading, and multiple anti-analysis .NET components to enable reconnaissance, lateral movement, and data theft. #Cavern #Cav3rn #CavernManticore #MuddyWater...