Is CVE-2024-4885 (Progress WhatsUp Gold Path Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2024-4885 to its Known Exploited Vulnerabilities catalogue on 3 March 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for a KEV-listed CVE

For a vulnerability like CVE-2024-4885, “exploited in the wild” is the operational question that matters most. Once a flaw appears in CISA’s KEV catalogue, defenders should assume real attacker use, not just theoretical exposure, and treat the product as a live attack surface until patching or mitigation is complete.

The practical implication is that you should not wait for a local alert or a vendor confirmation of compromise before acting. The appearance of a path traversal issue in an internet-facing product raises the likelihood of unauthenticated access, file access, and follow-on code execution attempts, which makes triage and containment time-sensitive.

For a broader playbook on how to handle actively exploited flaws, see Zero-Day and Exploited Vulnerabilities Guide.

Why this vulnerability is operationally urgent

Path traversal in a management product is not just a “web bug.” In practice, it can let an attacker step outside the intended web root and reach files or execution paths that were never meant to be exposed. Because the direct answer states that this issue allows unauthenticated remote code execution, the impact is immediate: exposure is not limited to disclosure, it can become full compromise of the appliance or server.

That changes prioritisation. A KEV listing tells you the vulnerability has crossed from “possible” to “confirmed exploitation pressure,” so the usual patch queue should give way to emergency handling. If the product is externally reachable, assume the issue is being scanned for and exploited at scale, especially while public reporting is active.

Use CISA Known Exploited Vulnerabilities Catalog as the operational trigger for remediation timing, and consult NIST National Vulnerability Database for canonical record details and product context.

What defenders should do before and after remediation

Start by confirming whether any WhatsUp Gold instances exist, whether they are internet-facing, and whether they are part of a high-value management segment. Then treat the affected systems as potentially exposed even if no obvious service interruption is visible. A vulnerability that enables unauthenticated access can be abused silently, so absence of an outage is not evidence of safety.

If patching is delayed, reduce exposure immediately by restricting network reachability to the management plane, limiting administrative access paths, and monitoring for unusual requests, process creation, or file changes around the product. After patching or mitigation, review the host for signs of pre-remediation compromise, because KEV-listed flaws are often exploited before organisations can apply the fix.

If the product could have exposed credentials, session material, or internal network access, rotate the relevant secrets and revalidate any accounts or service permissions that were reachable from the system. For a vulnerability-management lens on urgency, exception handling, and post-fix verification, see Vulnerability Management Guide.

Risk and Threat Considerations

A path traversal flaw in a management platform creates two overlapping risks: direct compromise of the system and secondary access into the environment it manages. Because the vulnerability is unauthenticated and can lead to remote code execution, the attacker does not need prior foothold, valid credentials, or user interaction to begin the attack path.

Failure mechanism: The attacker abuses path traversal to escape intended file-path boundaries, reaches sensitive code or configuration paths, and uses that access to execute commands or implant persistence before defenders notice.

Impact: Successful exploitation can expose the host, the managed environment, and any credentials or administrative trust stored on or reachable from the system, turning a single product flaw into a broader compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE exploitation and KEV triage are core vulnerability-management activities.
Recommendation — Prioritise KEV-listed flaws for emergency remediation and verify exposure continuously.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	The question depends on identifying whether the product is exposed to a known exploited flaw.
	RS.MI-03 — Mitigation	Active exploitation demands rapid containment and remediation actions.
Recommendation — Identify affected assets and mark KEV-listed vulnerabilities for immediate response. Contain affected instances quickly and apply the vendor fix or mitigation without delay.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The issue calls for tracking known exploited vulnerabilities and validating exposure.
	SI-2 — Flaw Remediation	The vulnerability requires urgent patching or mitigation and post-fix validation.
Recommendation — Continuously monitor for KEV-listed vulnerabilities and verify whether affected systems remain exposed. Apply the vendor remediation promptly and validate that the fix is actually in place.

Practitioner Guidance

What to prioritise: Treat KEV listing as a remediation trigger, not a reporting note. If the product is internet-facing or supports privileged monitoring functions, move it to the front of the queue and assume active exploitation until proven otherwise.

What to verify: Confirm the exact deployment footprint, then verify whether the host was accessible before patching and whether any unusual file access, web requests, or process activity occurred around the KEV date. If there is any doubt, expand the review to adjacent systems the appliance could reach.

Decision rule: If you cannot patch immediately, remove exposure first, then investigate. Do not let the absence of a visible alert delay containment when the product itself sits on an active exploitation list.

Practitioner takeaway: For KEV-listed management-plane flaws, the right question is not “has it been exploited here yet?” but “what access could an attacker have gained before we finished fixing it?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org