CVE-2023-47246

The vulnerability in SysAid On-Premise prior to version 23.3.36 is characterized as a path traversal flaw, which allows an attacker to manipulate file paths in a way that can lead to unauthorized file access and code execution. This occurs when the application fails to properly sanitize user input, particularly when handling file paths. By exploiting this weakness, an attacker can write malicious files to the Tomcat webroot directory, which is a critical component of the web server environment. Once the malicious file is executed, it can lead to a complete compromise of the server, allowing the attacker to execute arbitrary code with the same privileges as the web server process.

The attack vector for this vulnerability is primarily through web-based interactions with the SysAid application. An attacker could craft a specially designed request that includes path traversal sequences, such as "../", to navigate the file system and reach sensitive directories. This could be done through various means, including but not limited to, exploiting forms, API endpoints, or any other user input fields that interact with the file system. Once the attacker successfully writes a malicious file to the webroot, they can trigger its execution, leading to potential data breaches, unauthorized access to sensitive information, or further lateral movement within the network.

The real-world impact of this vulnerability is significant, particularly for organizations that rely on SysAid for IT service management. Given the CVSS score of 9.8, this vulnerability is classified as critical, indicating a high likelihood of exploitation and severe consequences if successful. The potential business risks include data loss, reputational damage, and financial implications stemming from remediation efforts and regulatory fines, especially if sensitive customer or employee data is compromised. Furthermore, the exploitation of this vulnerability could lead to a broader compromise of the organization’s IT infrastructure, as attackers may use the initial foothold to escalate privileges or pivot to other systems.

To effectively detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. First, it is crucial to ensure that all instances of SysAid On-Premise are updated to the latest version, as this will eliminate the known vulnerability. Regular patch management practices should be established to ensure that all software is kept up to date. Additionally, organizations should conduct thorough security assessments and penetration testing to identify any potential weaknesses in their applications. Implementing web application firewalls (WAFs) can also help to filter out malicious requests that may attempt to exploit this vulnerability. Finally, monitoring logs for unusual file access patterns or unauthorized file creations can provide early indicators of an attempted exploitation.

In conclusion, the path traversal vulnerability in SysAid On-Premise presents a critical risk to organizations utilizing this software. The ability for an attacker to execute arbitrary code through this flaw underscores the importance of maintaining robust security practices, including timely updates, proactive monitoring, and comprehensive security assessments. By addressing this vulnerability and implementing strong security measures, organizations can significantly reduce their risk exposure and protect their critical assets from potential exploitation.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the CVE-2023-47246 vulnerability in SysAid On-Premise. Our telemetry indicates a doubling in observed attack activity, signaling increased adversary interest and operational tempo. This surge coincides with the public availability of multiple proof-of-concept exploits on widely accessed platforms, which lowers the barrier for threat actors to weaponize this critical path traversal flaw. The presence of ransomware-linked activity further elevates the threat profile, as attackers leverage this vulnerability to deploy malicious payloads with potential for significant operational disruption. While the EPSS score remains high and stable, the amplification in real-world exploitation attempts underscores an urgent need for heightened vigilance. Consequently, the risk landscape has intensified, reflecting a transition from theoretical to active exploitation, thereby increasing the likelihood of successful compromise for organizations running vulnerable SysAid versions.

Update 2 — July 05, 2026

CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2023-47246, accompanied by a growing presence of publicly available proof-of-concept exploits on GitHub. This uptick in activity, while moderate, signals sustained attacker interest and a potential broadening of the threat actor base leveraging this critical SysAid vulnerability. The continued association with ransomware deployment remains a significant concern, as adversaries exploit the path traversal flaw to gain persistent access and execute malicious payloads within compromised environments. Although the Exploit Prediction Scoring System (EPSS) score remains stable at an extremely high level, the incremental rise in telemetry detections indicates that exploitation is becoming more frequent in operational settings. This evolving landscape heightens the urgency for defenders to monitor for indicators of compromise related to this vulnerability, as the risk of successful intrusion and subsequent ransomware impact is increasingly tangible.

Update 3 — July 15, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2023-47246, with telemetry indicating a significant uptick in adversary activity leveraging this path traversal vulnerability. This surge is accompanied by the emergence of multiple new proof-of-concept exploits publicly available on GitHub, which lowers the barrier for threat actors to weaponize the flaw. The persistence of ransomware groups exploiting this vulnerability remains a critical concern, as increased exploitation frequency correlates with a heightened risk of successful intrusions leading to ransomware deployment. Although the EPSS score remains near its peak, the current trend in detection activity signals a shift from isolated incidents to more widespread operational use. Consequently, the threat level for organizations running vulnerable SysAid On-Premise versions is elevated, underscoring the growing urgency for vigilant monitoring and incident response readiness.

Update 4 — July 23, 2026

CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2023-47246, indicating continued adversary interest and operational use. This uptick, while modest, reflects persistent activity rather than isolated incidents, suggesting that threat actors—particularly ransomware groups—are maintaining or marginally expanding their campaigns leveraging this critical SysAid On-Premise vulnerability. The availability of multiple proof-of-concept exploits on public repositories continues to lower the barrier for exploitation, potentially broadening the attacker base. Although the EPSS score remains stable near its peak, the incremental rise in telemetry signals a sustained threat environment that defenders must monitor closely. This evolving landscape elevates the risk profile for organizations running vulnerable SysAid versions, as even a slight increase in exploitation attempts can translate into higher likelihood of successful intrusions and ransomware deployment.

Update 5 — August 15, 2026

CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2023-47246, reflecting a continuing upward trend in attacker activity against vulnerable SysAid On-Premise deployments. This escalation, while moderate, underscores persistent adversary interest facilitated by publicly available proof-of-concept exploits that simplify operational execution. Our telemetry indicates that threat actors remain actively probing for opportunities to leverage this path traversal vulnerability to achieve remote code execution, with ransomware groups continuing to be implicated in observed campaigns. Although the EPSS score remains near its peak and stable, the incremental rise in exploitation signals a sustained and evolving threat environment that heightens the risk of successful compromise. Defenders should interpret this as an indication that the attack surface remains attractive and that exploitation attempts are unlikely to diminish in the near term, thereby maintaining the criticality of vigilant monitoring.