CVE-2024-4885: Progress WhatsUp Gold path traversal enables unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS score of 9.8, confirmed exploitation in CISA KEV, and an EPSS probability above 99% make this an urgent patching priority.

What it is

WhatsUp Gold versions before 2023.1.3 contain a path traversal flaw in WhatsUp.ExportUtilities.Export.GetFileWithoutZip that allows unauthenticated attackers to execute commands. Because the endpoint is reachable without credentials and the flaw leads to code execution, it is a severe risk to internet-facing deployments.

Impact

An attacker can run arbitrary commands on the server with iisapppool\nmconsole privileges, giving them a foothold on the monitoring host. That access can be used to pivot into the network WhatsUp Gold manages.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication (PR:N) and no user interaction (UI:N) required. Any exposed WhatsUp Gold instance running a version before 2023.1.3 is a candidate target.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-03-03, and EPSS shows a 30-day probability of 0.99288 (99.9th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in the record.

What to do

• Upgrade WhatsUp Gold to 2023.1.3 or later as the primary fix.
• If immediate patching is not possible, restrict network access to the WhatsUp Gold web interface to trusted management networks only.
• Follow the vendor security bulletin and CISA KEV required actions, including BOD 22-01 guidance for cloud services.
• Discontinue use of the product if mitigations cannot be applied.
• Monitor the iisapppool\nmconsole account for unexpected command execution or file access.

Detection

• Review web server and application logs for requests to the ExportUtilities/Export/GetFileWithoutZip endpoint, especially with path traversal sequences.
• Alert on process creation events spawned by the iisapppool\nmconsole identity, which should not normally launch arbitrary commands.
• Hunt for unusual file reads or writes outside expected WhatsUp Gold directories that could indicate traversal.
• Correlate network connections to the WhatsUp Gold host from untrusted sources with subsequent command execution activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.