A critical security flaw in Progress Software’s WhatsUp Gold, a network monitoring application, is being actively exploited by threat actors. The flaw, tracked as CVE-2024-4885 (CVSS score of 9.8/10) is an unauthenticated remote code execution vulnerability that affects versions 23.1.2 and older, allowing attackers to execute commands with elevated privileges due to inadequate validation in the “GetFileWithoutZip” method. Discovered by security researcher Sina Kheirkhah, the flaw’s proof-of-concept (PoC) exploit targets the ‘/NmAPI/RecurringReport’ endpoint, enabling attackers to execute code in the context of the service account. Exploitation attempts have been observed since August 1, 2024, from multiple IP addresses. Progress Software released a security bulletin on June 25, 2024, addressing this and other critical vulnerabilities (CVE-2024-4883, CVE-2024-4884, and CVE-2024-5009). Administrators are urged to upgrade to version 23.1.3, restrict access to trusted IP addresses, and monitor for suspicious activity to mitigate risks. The vendor also recommends placing WhatsUp Gold behind a firewall and ensuring it is only accessible internally or via trusted IP addresses. CTIX analysts will continue to report on interesting and novel exploits in future issues.