Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-4885

CVE-2024-4885CRITICAL

Progress Software Corporation WhatsUp Gold — WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9929   99.9   YES

AFFECTED
  Product       Versions    Fixed
  WhatsUp Gold  2023.1.0 –  —

TIMELINE
  May 14  Reserved by ProgressSoftware
  Jun 25  Published (CNA: ProgressSoftware)
  Mar 3   Added to CISA KEV, remediation due 2025-03-24

CWE-22 · CNA: ProgressSoftware · CVSS v3.1 · 3 references · KEV due March 24, 2025

Description

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 14, 2024	Reserved	Reserved by ProgressSoftware
June 25, 2024	Published	Published (CNA: ProgressSoftware)
March 3, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-03-24

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Progress Software Corporation	WhatsUp Gold	—	2023.1.0	—

Weaknesses

CWE-22

References (3)

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 [vendor-advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4885 [government-resource]
https://www.progress.com/network-monitoring [product]

Authoritative record: CVE-2024-4885 at cve.org

Vendors: progress

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-4885 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.