SysAid Patches 4 Critical Flaws Enabling Pre-Auth RCE in On

CVE-2023-47246 is a critical (CVSS 9.8) path traversal flaw (CWE-22) in SysAid On-Premise before version 23.3.36 that allows an unauthenticated, network-located attacker to write attacker-controlled files into the Tomcat webroot of the SysAid server. Once a file is written into that webroot, it is executed by the Tomcat application server, resulting in remote code execution on the ITSM server. Because the flaw requires no authentication or user interaction, any internet-exposed SysAid On-Premise server is directly reachable, and compromise can lead to data theft and ransomware deployment; the Lace Tempest group behind the MOVEit attacks has exploited it, and ransomware use is known. Only SysAid On-Premise deployments are affected, and the vendor fixed the issue in version 23.3.36. The vulnerability is confirmed exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-13, and carries a 98.9% EPSS probability of exploitation within 30 days.

Do: Upgrade SysAid On-Premise to version 23.3.36 or later immediately, per the vendor's security notification. Because this is KEV-listed with known ransomware use by Lace Tempest, also inspect the Tomcat webroot and deployed webapps for unauthorized files (e.g., WAR files), review for unauthorized accounts and unusual processes, and check for signs of lateral movement on compromised hosts. Organizations unable to patch should apply mitigations per the vendor's instructions or discontinue use of the product, per the CISA required action.

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

SysAid On-Prem, an IT service management (ITSM) platform, is vulnerable to an unauthenticated XML External Entity (XXE) flaw (CWE-611) in its Server URL processing functionality. Because the XML parser accepts attacker-controlled external entities without restriction, any remote attacker who can reach the vulnerable endpoint can trigger the flaw with no credentials and no user interaction. Successful exploitation gives the attacker arbitrary file-read primitives on the server, which can be leveraged to hijack an administrator account; public research (watchTowr) demonstrates chaining this XXE into pre-auth remote code execution, and related reporting notes SSRF and remote file access in active attacks. All SysAid On-Prem deployments running version 23.3.40 or earlier are affected. Exploitation is ongoing: CISA added CVE-2025-2776 to the Known Exploited Vulnerabilities catalog on 2025-07-22, and EPSS assigns a 64.4% probability of exploitation within 30 days.

Do: Upgrade all SysAid On-Prem installations to a release newer than 23.3.40 per the vendor's patched advisory, applying the other recently patched SysAid fixes as well since the public PoC chains this XXE with additional flaws into pre-auth RCE. Until patched, limit internet exposure of the SysAid server and check logs for XXE/SSRF activity and unexpected administrator logins. CISA's BOD 22-01 directive requires federal agencies to apply vendor mitigations or discontinue use of the product; the PoC is public and exploitation is confirmed, so treat this as urgent.

SysAid On-Prem versions 23.3.40 and earlier contain an unauthenticated XML External Entity (XXE) injection flaw (CWE-611) in the functionality that processes lshw (hardware inventory) data. Because the XML parser resolves external entities from network-supplied input without requiring authentication, a remote attacker can inject malicious entity definitions into lshw processing requests. Successful exploitation yields arbitrary file-read primitives and can be leveraged to take over an administrator account (CVSS 3.1: 9.8). All organizations running affected on-premises SysAid builds are in scope; cloud-hosted SysAid is not named in the advisory. Exploitation is likely in the wild: CISA has warned that SysAid flaws enabling remote file access and SSRF are under active attack, a public PoC has been released, and EPSS puts the 30-day exploitation probability at 72.2%.

Do: Upgrade SysAid On-Prem to a patched release newer than 23.3.40 as soon as possible (the vendor has patched this and related pre-auth flaws, per recent headlines). Until patched, minimize the server's internet exposure and restrict its outbound network access, since XXE exploitation can depend on the server resolving attacker-controlled external entities. Review logs for unexpected unauthenticated lshw/XML requests and for signs of administrator account changes or unusual file access.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.