CISA has warned that attackers are actively exploiting two security vulnerabilities in the SysAid IT service management (ITSM) software to hijack administrator accounts. The two unauthenticated XML External Entity (XXE) flaws, tracked as CVE-2025-2775 and CVE-2025-2776, were reported by watchTowr Labs security researchers in December 2024 and patched in March with the release of SysAid On-Prem version 24.4.60. One month later, watchTowr Labs also published proof-of-concept code, showing that the SysAid vulnerabilities are trivial to exploit and allow attackers to retrieve local files containing sensitive information. While CISA didn't share any additional details regarding these ongoing attacks, it did add the two vulnerabilities to its Known Exploited Vulnerabilities Catalog, giving…