---
id: "CVE-2024-4885"
kind: "vulnerability"
aliases: ["CVE-2024-4885"]
title: "progress whatsup gold: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "progress whatsup gold", "fixed": ["23.1.3"], "affected": "< 23.1.3", "ecosystem": "vendor"}, {"name": "Progress WhatsUp Gold", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "other", "self-hosted", "whatsup-gold", "windows"]
not_affected_if: ["unknown"]
published_at: "2024-06-25T20:15:12+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4885", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4885", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# progress whatsup gold: In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in…

Progress WhatsUp Gold, a network monitoring product, has a path traversal flaw that lets an unauthenticated remote attacker reach files outside the intended directory. The sources say this leads to remote code execution, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:progress whatsup gold affected < 23.1.3 fixed 23.1.3
- vendor:Progress WhatsUp Gold affected ? fixed ?

## Fix

Apply the vendor's mitigations per CISA guidance, or discontinue use of the product if mitigations are unavailable. Fixed version: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-4885
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-4885

## From the sources

Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_