CVE-2023-47246: SysAid On-Prem path traversal to code execution, exploited in the wild
The short version: SysAid On-Premise has a path-traversal flaw (CVE-2023-47246) that let an attacker write a file into the Tomcat web root and execute code on the server. It was exploited as a zero-day in November 2023 by a ransomware-linked actor, it's in CISA's KEV catalog, and a fix exists. If you run SysAid on-prem, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~98.9% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-12-04 |
| Known exploited? | Yes — exploited as a zero-day (Nov 2023); ransomware-associated |
| Vulnerability type | CWE-22 path traversal → file write to web root → remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | SysAid On-Premise before 23.3.36 |
| Fixed in | 23.3.36 (and later) |
What you need to know
CVE-2023-47246 is a path traversal in on-premises SysAid. By escaping the intended directory, an attacker writes an attacker-controlled file into the Tomcat webroot, and that file is then executed — turning a file-write primitive into code execution on the server.
This one wasn't theoretical for a moment:
- It's the help-desk platform. SysAid sits deep in IT operations and often holds privileged access — a compromise there reaches far beyond one host.
- It was live before the fix. Reporting attributed in-the-wild exploitation to a ransomware-linked group, using the flaw for initial access before a patch existed — so an unpatched, internet-facing instance may have been touched pre-patch.
How serious we see it
Critical — the 9.8 is earned here.
Unauthenticated, network-reachable code execution on an internal-facing operations platform, confirmed exploited in the wild and listed in KEV, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects on-prem SysAid below 23.3.36, and the fix is published. The catch is the usual zero-day catch — being patched and being clean are separate questions, so hunt as well as patch.
Recommendations
Straight from SysAid's advisory and CISA:
- Patch now. Upgrade SysAid On-Premise to 23.3.36 or later.
- Assume nothing given the zero-day window — hunt. Follow SysAid's guidance to check for indicators of compromise and evidence of pre-patch exploitation (unexpected files in the web root, unusual processes).
- If you find indicators, respond fully. Rebuild where warranted, and rotate credentials, keys, and tokens the server could reach.
- Restrict exposure. Keep SysAid off the open internet where possible; limit it to trusted networks or a VPN.
- Confirm your exposure first. Verify whether you run on-prem SysAid and which build.
How BreachRisk sees it
BreachRisk answers the first question — do we have an exposed, affected SysAid? — from the outside in. From little more than your domain it discovers internet-facing SysAid portals, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited CVE, pushed to the top of your results rather than lost in a scanner backlog. Safe verification isn't offered for this one — confirming it would require writing and leaving a persistent file — so BreachRisk detects and prioritizes it rather than exploiting it.
That continuous, attacker's-eye view is the whole point: when a help-desk zero-day breaks, the exposed appliance is already mapped, so you go straight to patch-and-verify.