[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [The SysAid Zero-Day Vulnerability: CVE-2023-47246](/blog/sysaid-0-day-2023) Publish date July 8, 2025 {x} minute read # The SysAid Zero-Day Vulnerability: CVE-2023-47246 [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Caitlin Postal](/team/caitlin-postal) Technical Writer Reviewed by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Table of contents Free resource ### [Download now](#) SysAid on-premises software faces a zero-day vulnerability tracked as CVE-2023-47246. SysAid recommends that all customers immediately upgrade to version 23.3.36, which has a security patch for the path traversal vulnerability. > "We urge all customers with SysAid on-prem server installations to **ensure that your SysAid systems are updated to version 23.3.36,** which remediates the identified vulnerability, and conduct a comprehensive compromise assessment of your network to look for any indicators further discussed below. Should you identify any indicators, take immediate action and follow your incident response protocols." SysAid CTO Sasha Shapirov in SysAid's [vulnerability notification](https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification) ## What is CVE-2023-47246? First detected by the [Microsoft Threat Intelligence team](https://twitter.com/MsftSecIntel/status/1722444141081076219) in early November 2023, the zero-day vulnerability tracked as [CVE-2023-47246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47246) affects SysAid on-premises IT service management systems. This vulnerability has been exploited by a known threat actor to gain unauthorized access, move through the system, and achieve code execution. The attacker uploaded a malicious payload that enabled them to inject trojan malware on the system. Though this vulnerability has not yet been added to the National Vulnerability Database at the time of publication, it has a CVE number of CVE-2023-47246 reserved with the MITRE Corporation and has been stated as a path traversal vulnerability that can lead to arbitrary code execution. It does not yet have a CVSS rating. With a path traversal vulnerability, attackers can navigate through the directory system and, in this case, manipulate files. Path traversal is identified as [CWE-35](https://cwe.mitre.org/data/definitions/35.html) and is often related to access control issues. Broken access control and injection attacks are two of the [OWASP Top 10](https://owasp.org/www-project-top-ten/) critical security risks. Through the SysAid vulnerability, the threat actor known as Lace Tempest uploaded a webshell into the Apache Tomcat service running on a SysAid server. Tomcat is an open-source web server, and the webroot of the SysAid Tomcat web service was the initial target for the attack. The hacker's webshell provided unauthorized access and control over the system, which the attacker leveraged to deploy malware. Using the \[.rt-script]user.exe\[.rt-script] malware loader, the attacker ran a Powershell script to inject the GraceWire trojan on three executables: \[.rt-script]spoolsv.exe\[.rt-script], \[.rt-script]msiexec.exe\[.rt-script], and \[.rt-script]svchost.exe\[.rt-script]. Each of these executables is used to run Windows services, so malware takeover can lead to a non-functioning device. The attacker then ran additional scripts to erase evidence of the attack and to run a Cobalt Strike listener for monitoring compromised hosts. These actions are typically followed by [data exfiltration](https://www.upguard.com/blog/how-to-detect-data-exfiltration) and [ransomware](https://www.upguard.com/blog/ransomware) deployment. The threat actor behind the attack on SysAid servers also [exploited a zero-day vulnerability in the MOVEit Transfer product](https://www.upguard.com/blog/the-moveit-0-day) earlier this year and is known to deploy cl0p ransomware attacks. GraceWire malware has also been linked to ransomware attacks and subsequent data breaches. According to SysAid, all customers with on-premises server installations are at risk. Upgrade your system to version 23.3.36 containing the security patch for this vulnerability. ### How UpGuard Can Help CVE-2023-47246 has been added to UpGuard's vulnerability library as an informational vulnerability, which means that UpGuard can detect if you are using the affected product. Search for **CVE-2023-47246** in your [Breach Risk](https://www.upguard.com/product/breach-risk) Vulnerabilities module and in the [Vendor Risk](https://www.upguard.com/product/vendorrisk) Portfolio Risk Profile to identify what assets may be impacted. Cross-check your version with the impacted versions to ensure that your system is protected against possible exploitation. UpGuard maintains a [vulnerability](https://www.upguard.com/blog/vulnerability) library with thousands of known cybersecurity vulnerabilities, and we will continue monitoring this situation for more information on the SysAid vulnerability. ## Mitigation Strategies for CVE-2023-47246 In their November 2023 vulnerability notice, SysAid provides guidance on what actions customers can take to protect against this vulnerability. SysAid partnered with Profero for the vulnerability investigation. ### Apply SysAid's Security Patch SysAid recommends that all customers using a SysAid on-prem server update to version 23.3.36 immediately, as that version contains the security patch for the vulnerability. ### Evaluate Potential Compromise SysAid recommends assessing your SysAid on-prem software for any of the known indicators of compromise (IOCs) and any suspicious behavior in server logs. Assess behavior on your SysAid server for the following behaviors: * Unauthorized access or suspicious uploads in the SysAid Tomcat service. * Unexpected files that do not match the installation date in the webroot directory. * Unauthorized or suspect WebShell deployment in the SysAid Tomcat service. * Abnormal PowerShell script execution. * Unauthorized behavior on the three targeted processes (\[.rt-script]spoolsv.exe\[.rt-script], \[.rt-script]msiexec.exe\[.rt-script], \[.rt-script]svchost.exe\[.rt-script]). * Signs of the attacker's cleanup actions on their initial access. * Credentials and other sensitive information accessible through the affected system. Additionally, review the identifiers for the known threat actor, including the published hashes, IP addresses, file paths, and commands. The SysAid [vulnerability notification](https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification) lists the malicious identifiers and specific signs of exploitation. Microsoft Defender antivirus detection can also identify three threat components related to the SysAid zero-day vulnerability: * Trojan:Win32/TurtleLoader * Backdoor:Win32/Clop * Ransom:Win32/Clop If you identify potential compromise, follow your internal security policy for [incident response](https://www.upguard.com/blog/creating-a-cyber-security-incident-response-plan). Immediate shutdown and network disconnection may provide time to quarantine and disinfect the impacted system. ### Strengthen Your Cybersecurity Posture By taking proactive steps to harden your security stance, you can help prevent cyber attacks on your external attack surface. Consider the following additions to your cybersecurity measures: * Implement [access control](https://www.upguard.com/blog/access-control) using the [principle of least privilege](https://www.upguard.com/blog/principle-of-least-privilege). * Run [continuous monitoring](https://www.upguard.com/blog/continuous-security-monitoring) to maintain insight for your attack surface and cybersecurity posture. * Maintain an updated antivirus software. * Conduct annual [penetration testing](https://www.upguard.com/blog/penetration-testing) to identify potential weaknesses. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 26, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)