Yes. CISA added CVE-2024-6670 to its Known Exploited Vulnerabilities catalogue on 16 September 2024, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
Why active exploitation changes the answer
CVE-2024-6670 is not just a reported software flaw, it is a currently exploited vulnerability with confirmed attacker interest. For practitioners, that changes the question from “should we patch eventually?” to “are we exposed right now, and what evidence do we need to rule out abuse?”
Because CISA placed it in the Known Exploited Vulnerabilities catalogue, the safest assumption is that opportunistic scanning and follow-on exploitation are already part of the threat environment. That makes inventory accuracy, exposure confirmation, and emergency remediation more important than abstract severity debates.
For a practical triage view of actively exploited flaws, use Zero-Day and Exploited Vulnerabilities Guide alongside CISA's Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database so you can separate confirmed exploitation from general advisory noise.
What the SQL injection risk means in practice
The vulnerability type matters because SQL injection can turn a normal application request into direct database interaction. In this case, the direct answer states that an unauthenticated attacker can retrieve the user's encrypted password when the application is configured with only a single user, so the likely impact is not limited to service disruption, it can include credential exposure and a path to broader compromise.
SQL injection is especially dangerous in administrative or appliance-style products because the database often holds configuration data, account material, and operational state. Once an attacker can influence queries, the issue becomes a data exposure and trust boundary problem, not just an input validation bug.
For control depth on this attack class, link the issue to SQL Injection Prevention Guide and the broader database hardening posture in Database Security Guide.
What to do if you run WhatsUp Gold or cannot patch immediately
First confirm whether any internet-facing or internally reachable WhatsUp Gold deployment exists, then compare that inventory with the vendor advisory and the CISA KEV entry. If you cannot patch immediately, reduce exposure by restricting access to the management interface, segmenting the host, and watching for abnormal database or application access patterns.
When patching must wait, treat the system as a high-risk asset until you can verify whether exploitation has already occurred. That means checking for unexpected account activity, reviewing application and database logs, and preserving evidence before making disruptive changes that could erase traces.
If this is part of a broader vulnerability program, the Vulnerability Management Guide is the best internal reference for prioritisation, verification, and exception handling. For prioritising exposure, the FIRST EPSS model can complement KEV status when you are deciding what to remediate first across a backlog.
Risk and Threat Considerations
Confirmed in-the-wild exploitation means the risk is no longer hypothetical. Attackers are likely to probe exposed instances quickly, and SQL injection in a management product can expose data that helps them move from initial access to credential theft or wider administrative compromise.
Failure mechanism: The application accepts attacker-controlled input that reaches a database query, allowing an unauthenticated request to pull sensitive data from the back end when the deployment is in the vulnerable configuration.
Impact: Exposure of encrypted password material can enable offline attack, account compromise, and in some environments a broader foothold into the managed network if the product is trusted operationally.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Directly governs remediation of actively exploited software flaws. |
| AU-2 — Event Logging | Logging is needed to detect suspicious database and application activity around exploitation. | |
| AC-4 — Information Flow Enforcement | Restricting access paths helps contain exposed management interfaces during delayed patching. | |
| Recommendation — Prioritise and track remediation of the exploited WhatsUp Gold flaw immediately. Verify logs capture the affected application, database, and admin access events. Limit access to the WhatsUp Gold management interface and isolate the host. | ||
| OWASP ASVS | V1 — Encoding and Sanitization | SQL injection is an input-handling flaw addressed by secure encoding and sanitization practice. |
| V4 — API and Web Service | The issue affects request handling that reaches server-side data access paths. | |
| Recommendation — Validate inputs and remove unsafe query construction that enables SQL injection. Review server-side request handling that can reach database queries without authentication. | ||
Practitioner Guidance
What to verify: Confirm whether any instance is reachable from untrusted networks, whether the deployment matches the vulnerable single-user condition, and whether logs show unusual requests against the affected application paths.
Decision rule: If the product is exposed and patching is delayed, prioritise containment and compromise assessment before routine hardening work. If the environment is already isolated and tightly monitored, focus on validating that the exposure really is absent rather than assuming the KEV listing is only theoretical.
What to measure: Track time from KEV publication to containment, patch, and evidence review. For an exploited vulnerability, speed of validation matters as much as speed of remediation.
Practitioner takeaway: For a KEV-listed SQL injection, the right posture is to assume active targeting until you have proven otherwise, then verify exposure, contain first if needed, and only then decide whether any credential or session material needs rotation.
Related resources from NHI Mgmt Group
- CVE-2024-6670 (Progress WhatsUp Gold SQL Injection)
- Is CVE-2024-29824 (Ivanti Endpoint Manager (EPM) SQL Injection) being exploited in the wild?
- Is CVE-2024-9465 (Palo Alto Networks Expedition SQL Injection) being exploited in the wild?
- Is CVE-2024-43468 (Microsoft Configuration Manager SQL Injection) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org