CVE-2024-4884 is a critical unauthenticated remote code execution flaw in Progress WhatsUp Gold, scored 9.8. The APM CommunityController runs commands with the web console application pool identity. Versions before 2023.1.3 are affected, so upgrade to 2023.1.3 or later.
What's affected
The record names the class Apm.UI.Areas.APM.Controllers.CommunityController as the vulnerable component. It states that commands run with iisapppool\nmconsole privileges, which is the identity of the web console's application pool, and that no authentication is required.
Versions before 2023.1.3 are affected per NVD. The Progress June 2024 security bulletin is the vendor reference, but it did not render in my fetch, so I could not confirm anything beyond the record, including whether later releases changed the guidance. Read it before you schedule the work.
This CVE sits next to CVE-2024-4883, which affects the same versions through NmApi.exe and runs as a different service account. Fixing one by upgrading fixes both.
The weaknesses are CWE-77, CWE-78 and CWE-94.
How to check if you're exposed
Read the version from the console's Help and About page, or from Windows installed programs on the server. Anything below 2023.1.3 is in scope.
This one concerns the web console, so look at who can reach it. The application pool identity is the account that would run any injected commands, so check what that identity can touch. Review file system rights and what local secrets it can read.
What to do now
- Inventory WhatsUp Gold installs and versions.
- Upgrade to 2023.1.3 or later using the bulletin's instructions.
- Limit the web console to an administrative network segment until the upgrade is done.
- Review the rights of the
nmconsoleapplication pool account and cut anything unnecessary. - Look at the IIS logs for requests to the APM community area that you cannot explain, and keep them for any later investigation.
Why it matters
The web tier of a monitoring product is a juicy target because it is reachable by many people and sits next to stored device credentials. A flaw that gives code execution there without a login is exposed to anyone who can open the page.
The CVE falls in the injection family: attacker controlled input is treated as commands. The identity matters for blast radius. The application pool account is less powerful than a full administrator account, but it can read the product's configuration and often reach the database, and attackers commonly use it as a first step.
The record has kev set to false for this CVE and does not describe exploitation.
Quick check
Which component is affected?
The record names the APM area's CommunityController in the WhatsUp Gold web console.
Does one upgrade cover this and CVE-2024-4883?
Both are described as affecting versions before 2023.1.3, so a move to 2023.1.3 or later addresses both, per the record. Confirm in the bulletin.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (page did not render for fetch)
- NVD record for CVE-2024-4884
Last reviewed: 19 October 2026.
