Critical Vulnerability: SysAid CVE-2023-47246

**Executive Summary:** Huntress details a critical path‑traversal RCE in SysAid on‑prem servers (CVE-2023-47246) that allows attackers to write WAR webshells to the Tomcat webroot and gain code execution; the activity is attributed to the cl0p/TA505 ransomware group, a weaponized proof‑of‑concept was developed (not released), and Huntress observed at least one active compromise while urging immediate patching to SysAid Server 23.3.36 and deploying detections.