How do I check whether I am affected by CVE-2023-47246?

Check the SysAid version: anything before 23.3.36 is vulnerable. Hunt for compromise: look for usersfiles.war or unexpected WAR/ZIP/JSP files in C:\Program Files\SysAidServer\tomcat\webapps (especially usersfiles\user.exe) with odd timestamps. Look for cmd.exe or PowerShell spawned by the SysAid Wrapper.exe Java process. Check WAF/proxy logs for suspicious POSTs. Note the attacker scrubs log lines matching userentry|getLogo.jsp|ldapSyms|usersfile. IOCs: user.exe sha256 b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d; C2 81.19.138[.]52, 45.182.189[.]100, 179.60.150[.]34.

What is the fix for CVE-2023-47246?

Upgrade SysAid on-prem server to 23.3.36 or later. Then run a compromise assessment, and rotate credentials and data reachable from the SysAid server. Treat the host as compromised if any IOC is found and follow incident response.

Who is not affected by CVE-2023-47246?

Not affected if: cloud-hosted, managed-hosting, sysaid-saas.

Live › vulnerability › CVE-2023-47246

Go to dashboard

critical9.8Exploited in the wildVendor

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes…

Path traversal in SysAid on-prem server lets an unauthenticated attacker write a WAR webshell into the Tomcat webroot and get code execution. Exploited as a zero-day by Lace Tempest (DEV-0950) from Oct-Nov 2023, delivering GraceWire, Cobalt Strike and Clop ransomware. Fixed in 23.3.36. Patching does not remove an existing compromise.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Nov 10, 2023 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Nov 13, 2023.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs code on the SysAid server and can reach its data.
CVSS said: 9.8. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2023-47246

Go to dashboard

critical9.8Exploited in the wildVendor

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Nov 10, 2023 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Nov 13, 2023.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs code on the SysAid server and can reach its data.
CVSS said: 9.8. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
SysAid SysAid Server	vendor	–	–
SysAid Server	vendor	< 23.3.36	23.3.36
sysaid	vendor	< 23.3.36	23.3.36

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes…

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes…

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources