Loading story…
Researchers disclosed a pre-authentication remote code execution chain affecting SysAid On-Premise, showing that unauthenticated attackers could reach code execution through the product’s support ticket-related functionality. The issue was publicly described by WatchTowr Labs and Summoning Team under the title “SysOwned, Your Friendly Support Ticket,” with CVE-2025-2775 identified as a key part of the exploit chain alongside additional related flaws.
The reports indicate the vulnerability chain can be triggered without prior authentication, making internet-exposed SysAid On-Premise deployments a high-risk target because attackers may be able to compromise servers directly through the application. Public disclosure by multiple security researchers increases the likelihood of defender scrutiny and attacker interest, particularly for organizations relying on on-premises help desk infrastructure.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Security researchers disclosed a pre-authentication remote code execution chain affecting SysAid On-Premise. The chain includes CVE-2025-2775 and additional related flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple **BMC FootPrints ITSM** vulnerabilities that can be chained to achieve **pre-authenticated remote code execution**, highlighting the product as a high-value target because ITSM platforms often contain asset inventories, incident data, configuration details, and other operationally sensitive information. *watchTowr Labs* said it found and chained flaws in 2025 against what was then a fully patched deployment, while broader reporting noted a set of four issues affecting the platform and framed the exposure as part of a wider pattern of attackers abusing enterprise management software. A related disclosure, **CVE-2025-71260**, affects BMC FootPrints versions `20.20.02` through `20.24.01.001` and stems from unsafe ASP.NET `VIEWSTATE` deserialization, allowing an authenticated attacker to execute arbitrary code and fully compromise the application. The vendor has issued hotfixes for affected releases, but the references do not all describe the exact same exploit chain: the watchTowr research focuses on **pre-auth RCE chains**, while the CVE entry covers a specific **authenticated** deserialization bug, making it adjacent but not fully the same incident thread.
Jun 29, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Aug 26, 2026
Researchers disclosed **CVE-2025-25256**, a pre-authentication command injection vulnerability in **Fortinet FortiSIEM** that could allow an unauthenticated attacker to execute commands on exposed systems without logging in first. The issue was detailed by watchTowr Labs and echoed by Summoning Team, both highlighting the risk posed by a flaw in a security monitoring product that is often deployed with broad visibility into enterprise environments. The available reporting identifies the bug as a **pre-auth** attack path with potential for remote exploitation, but the supplied references do not include affected version details, confirmed in-the-wild abuse, or vendor remediation guidance. Even with those gaps, the disclosure raises urgent concern because successful exploitation of a SIEM platform could give attackers a foothold in a high-value security appliance and access to sensitive operational data.
Aug 1, 2026