CVE-2023-47246: SysAid On-Premise path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution, active in-the-wild exploitation, KEV listing with ransomware use, and near-maximum EPSS score.

What it is

SysAid On-Premise before 23.3.36 contains a path traversal flaw that lets an unauthenticated attacker write a file into the Tomcat webroot, which then executes as code. It was exploited in the wild in November 2023 and is listed in CISA's KEV catalog with known ransomware campaign use, so internet-facing instances are at immediate risk.

Impact

An attacker gains remote code execution on the SysAid server, allowing full compromise of the host and any data or credentials it holds. Given the KEV ransomware association, follow-on ransomware deployment is a realistic outcome.

Attack surface

Reachable over the network via the SysAid web interface with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed On-Premise instance below 23.3.36 is a candidate target.

Exploitation

Exploited in the wild as of November 2023 and added to CISA KEV on 2023-11-13 with a 2023-12-04 remediation due date; EPSS 30-day probability is 0.98851 (99.9th percentile). Vendor and government references are tagged Exploit and US Government Resource.

What to do

• Upgrade SysAid On-Premise to 23.3.36 or later immediately; this is the only complete fix.
• If patching cannot be done at once, remove the instance from internet exposure and apply the vendor's documented security enhancements.
• Follow the vendor's post-exploitation guidance to check for and remove any files or web shells written to the Tomcat webroot.
• Rotate credentials and secrets stored or processed by the SysAid server, and review it for signs of lateral movement.
• Treat the host as potentially compromised if it was exposed before patching, and rebuild if compromise is confirmed.

Detection

• Monitor the Tomcat webroot and SysAid application directories for newly created or modified files, especially unexpected scripts or archives.
• Alert on suspicious child processes spawned by the Tomcat/SysAid service, such as command shells or scripting interpreters.
• Review web server and SysAid logs for path traversal patterns (../ sequences) and anomalous POST requests around the exploitation window.
• Hunt for outbound connections or tooling consistent with ransomware staging on hosts running SysAid On-Premise.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.