#sysaid

Analysis · May 20, 2026 · Colten Anderson

SysAid customers got the patch the same week they learned they were already breached

CVE-2023-47246 was a SysAid zero-day before it was a CVE. The Cl0p operator Lace Tempest, fresh off MOVEit, was writing webshells to Tomcat and deploying ransomware while the vendor was still writing the advisory. When the attacker has the bug first, detection matters as much as patching.