CVE-2024-4885 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2024-06-25

Added to CISA KEV: 2025-03-03 251 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately upgrade to WhatsUp Gold version 2023.1.3 or later
If immediate patching is not possible, restrict network access to WhatsUp Gold interfaces to trusted IP ranges only
Monitor WhatsUp Gold logs for suspicious API calls to GetFileWithoutZip endpoint
Review system logs for unauthorized command execution or privilege escalation
Patch priority: EMERGENCY - Apply within 24-48 hours due to active exploitation

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2024-4885 is a critical-severity, unauthenticated Remote Code Execution (RCE) vulnerability affecting Progress WhatsUp Gold ^[1] ^[4].

Exploitation and Threat Actor Activity

Active Exploitation: The vulnerability has been subject to active exploitation in the wild ^[4]. Threat actors have used it to gain initial access to corporate networks ^[4].
Proof-of-Concept (PoC): Publicly available PoC exploit code exists, which has facilitated exploitation efforts by targeting exposed WhatsUp Gold endpoints (specifically `/NmAPI/RecurringReport`) ^[3] ^[4].

Attack Method and Requirements

Attack Vector: The vulnerability is remotely exploitable over the network ^[6].
Authentication/Interaction: It is an unauthenticated vulnerability, meaning no login or valid credentials are required to exploit it ^[1]. Furthermore, no user interaction is required for a successful attack ^[7].
Mechanism: The flaw exists in the `WhatsUp.ExportUtilities.Export.GetFileWithoutZip` function, which allows for directory traversal and subsequent command execution ^[2].

Impact and Access

Impact: Successful exploitation allows an attacker to execute arbitrary code on the target server ^[1].
Privileges: Code execution occurs with the privileges of `iisapppool\nmconsole` ^[2].

Affected Versions and Mitigation

Affected Versions: Progress WhatsUp Gold versions released before 2023.1.3 (specifically including 23.1.2 and older) are vulnerable ^[1] ^[4].
Patch Status: Progress Software released a patch for this vulnerability on May 24, 2024, in WhatsUp Gold version 23.1.3 ^[5]. Organizations using affected versions should update to 23.1.3 or later to remediate the risk.

Sources

CVE-2024-4885 Detail - NVD
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.
CVE-2024-4885 - Vulnerability Details - OpenCVE
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.CVE-2024-4885 - WhatsUp Gold GetFileWithoutZip Dir…
sinsinology/CVE-2024-4885 - GitHub
Progress WhatsUp Gold GetFileWithoutZip Unauthenticated Remote Code Execution (CVE-2024-4885) Exploit by Sina Kheirkhah (@SinSinology) of SummoningTeam. ... Technical details: https://summoning.team/blog/progress-whatsup-gold-rce-cve-2024-4885/ (^_^). Prepare for the Pwnage (^_^) (+). Sending payloa…
Critical Progress WhatsUp RCE flaw now under active exploitation
Threat actors are actively attempting to exploit a recently fixed Progress WhatsUp Gold remote code execution vulnerability on exposed servers for initial access to corporate networks. The vulnerability leveraged in these attacks is CVE-2024-4885, a critical-severity (CVSS v3 score: 9.8) unauthentic…
Progress WhatsUp Gold - Unauthenticated RCE Vulnerability - Armis
CVE-2024-4885 is a critical unauthenticated RCE vulnerability. Learn about the vulnerability's impact and how Armis provided 223 days of ... Progress Software released the patch on May 24, 2024 in WhatsUp Gold version 23.1.3. Armis CentrixTM for Early Warning, added AI intelligence that collected an…
NVD - CVE-2024-4885
CVE-2024-4885 Detail. Description. In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.Quick Info. CVE Dictionary Entry: CVE-2024-4885 NVD Published Date: 06/25/2024 NVD Last Modified: 10/31/2025 Source: Progress Software…
In WhatsUp Gold versions released before 2023.1.3, an.
Published by the National Vulnerability Database Jun 25, 2024.CVSS v3 base metrics. Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability. Attack complexity: More severe for the least complex attacks. Privileges required: M…

🔴 CVE-2024-4885