CVE-2024-4885: Progress WhatsUp Gold Path Traversal Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-03-03. EPSS: 99.3% chance of exploitation in the next 30 days.

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

Affected products

• Progress WhatsUp Gold: before 23.1.3 (fixed in 23.1.3)

Published 2024-06-25. Last modified 2026-06-17.