CriticalCISA KEVExploited in the wildPublic exploit

SysAid On-Premise Path Traversal to Code Execution

IdentifiersCVE-2023-47246CWE-22· Improper Limitation of a Pathname…

CVE-2023-47246 is a path traversal vulnerability in SysAid On-Premise before version 23.3.36. The flaw allows an attacker to write files outside the intended directory boundaries and place attacker-controlled content into the Tomcat webroot used by the SysAid application. According to the provided content, this file-write condition can be leveraged to upload a web shell and additional payloads into the SysAid Tomcat web service webroot, resulting in code execution. The vulnerability was exploited in the wild in November 2023.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can give an attacker unauthorized access to the affected SysAid server and control over the system. By writing a web shell or other payloads into the Tomcat webroot, the attacker can achieve remote code execution in the context of the application server, establish persistent access, execute follow-on payloads, and conduct post-exploitation activity on the compromised host.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of SysAid On-Premise instances, especially any internet-accessible deployments, and monitor aggressively for indicators of compromise. Prioritize detection of webroot file writes, web shell placement, Tomcat or Java processes spawning shells, and suspicious PowerShell or payload download activity. However, mitigation is only a temporary risk-reduction measure; the authoritative fix is upgrading to 23.3.36 or later and conducting incident-response validation on potentially exposed systems.

Remediation

Patch, then assume compromise.

Upgrade SysAid On-Premise to version 23.3.36 or later, as SysAid released 23.3.36 to remediate CVE-2023-47246. Because the vulnerability was exploited in the wild, affected organizations should also perform a comprehensive compromise assessment of systems running vulnerable versions, including review for web shells, unauthorized files in the Tomcat webroot, suspicious child processes spawned by Tomcat or other web components, and related post-exploitation artifacts.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2023-47246-EXPMaturityPoCVerified exploit

This repository contains a Python exploit script (CVE-2023-47246-EXP.py) targeting the SysAid Server remote code execution vulnerability (CVE-2023-47246). The exploit works by uploading a user-supplied web shell (e.g., shell.jsp) to a vulnerable SysAid Server (version <23.3.36) via a crafted HTTP request. The script compresses and hex-encodes the shell file, then uploads it to the target server, and finally verifies if the shell is accessible. The README provides usage instructions, affected versions, fingerprinting tips for identifying SysAid servers, and references to further information. The repository also includes a requirements.txt for dependencies and a minimal text file. The exploit is operational, requiring the attacker to supply a shell file and a target URL, and results in remote code execution if successful.

W01fh4ckerDisclosed Nov 17, 2023pythonnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SysaidSysaidapplication

SysaidSysaid On-Premisesapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

splunk researchNews

Feb 25, 2026

Detection: Windows Suspicious Child Process Spawned From WebServer | Splunk Security Content

A vulnerability affecting SysAid On-Prem Software referenced as an associated analytic story.

splunk researchNews

Feb 9, 2026

Detection: Windows File Download Via PowerShell | Splunk Security Content

Referenced only as an associated analytic story for SysAid On-Prem Software; no vulnerability details are provided in the content.

labs greynoise ioNews

Feb 7, 2026

GreyNoise Labs Weekly OAST (Well-known Out-of-band Interaction Domains) Report • Week Ending 2026-02-06 - GreyNoise Labs

Command injection vulnerability in pfSense pfBlockerNG referenced as a target in scanning activity.

splunk researchNews

Oct 17, 2025

Detection: Windows Powershell DownloadString | Splunk Security Content

A vulnerability identified as CVE-2023-47246 in SysAid On-Prem Software is referenced as an associated analytic story, but no technical details are provided in the content.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware2

Malware families riding this exploit, with evidence and IOCs.

Detection signatures2

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2023-47246

NVD

nvd.nist.gov/vuln/detail/CVE-2023-47246

MITRE CWE · CWE-22

Improper Limitation of a Pathname to a…

Vendor Advisory

documentation.sysaid.com/docs/on-premise-security-enhancements-2023

Vendor Advisory

sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

Product

documentation.sysaid.com/docs/latest-version-installation-files

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47246