CVE-2024-4883 is a critical remote code execution flaw in Progress WhatsUp Gold, scored 9.8. An unauthenticated attacker can run code as a service account through NmApi.exe. It affects versions released before 2023.1.3, so upgrade to 2023.1.3 or later.
What's affected
The record says WhatsUp Gold versions released before 2023.1.3 are affected, and that the code runs as a service account through NmApi.exe. No credentials are needed.
Version caveat: the vendor page for this CVE is Progress's June 2024 security bulletin. It did not load in my fetch because it renders in the browser, so the fixed version here is taken from the NVD wording ("before 2023.1.3"). Confirm in the bulletin and read its notes on any later releases.
A sibling flaw, CVE-2024-4884, was published the same day against the same product and version range through a different component. Plan both in one patch window.
The weaknesses are CWE-77, CWE-78 and CWE-94: command injection, OS command injection and code injection.
How to check if you're exposed
In the WhatsUp Gold web console, open the Help menu and choose About to read the version. On the server, the installed program list under Windows Settings shows the same value.
Then check reachability. Ask whether the WhatsUp Gold web and API ports are open to anything beyond your management network. From a trusted host on a segment you do not expect to have access, test whether the web interface answers. If it does, narrow the firewall rule.
What to do now
- Find every WhatsUp Gold server and read its version.
- Upgrade to 2023.1.3 or later, following the instructions in Progress's June 2024 bulletin.
- Restrict access to the WhatsUp Gold console and API to administrative networks.
- Review the service account the product runs under and remove rights it does not need.
- Check the server for unexpected processes and new local accounts, since a 9.8 unauthenticated flaw on a monitoring host justifies a look.
Why it matters
Network monitoring servers see a lot of the estate. They hold credentials for devices and have routes into many segments, so code execution on one is a strong foothold.
The class of flaw is injection: input from the network reaches a command or code interpreter without proper neutralization. Because the flaw needs no authentication, exposure depends mostly on network reachability, which is the thing you can change fastest.
The record's kev flag is false for CVE-2024-4883 and the record does not state exploitation. The bulletin I could not read may say more, so check it for exploitation notes.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need to log in?
No. The description says an unauthenticated attacker can achieve code execution.
Is this the same bug as CVE-2024-4884?
No. They share the product, version range and severity but involve different components. Patch both by upgrading.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (page did not render for fetch)
- NVD record for CVE-2024-4883
Last reviewed: 19 October 2026.
