How severe is CVE-2024-46909?

CVE-2024-46909 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-46909 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 49% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-46909?

CVE-2024-46909 affects Progress Whatsup Gold. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-46909?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-46909 have an EU (EUVD) identifier?

Yes. CVE-2024-46909 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-42186.

When was CVE-2024-46909 published?

CVE-2024-46909 was published on 2024-12-02 and last updated on 2026-06-17.

CVE-2024-46909

CVE-2024-46909 is a critical-severity vulnerability in Progress Whatsup Gold with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 49% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-16.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 49% (99th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-42186
Weakness: CWE-16
Affected product: Progress Whatsup Gold
Published: 2024-12-02
Last modified: 2026-06-17

Description

In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account.

Frequently asked questions

What is CVE-2024-46909?: In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account.
How severe is CVE-2024-46909?: CVE-2024-46909 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-46909 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 49% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-46909?: CVE-2024-46909 affects Progress Whatsup Gold. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-46909?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-46909 have an EU (EUVD) identifier?: Yes. CVE-2024-46909 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-42186.
When was CVE-2024-46909 published?: CVE-2024-46909 was published on 2024-12-02 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

More vulnerabilities in Progress Whatsup Gold

CVE-2024-8785 — Critical (CVSS 9.8): In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to…
CVE-2024-7763 — Critical (CVSS 9.8): In WhatsUp Gold versions released before 2024.0.0, an Authentication Bypass issue exists which allows an attacker to…
CVE-2024-6671 — Critical (CVSS 9.8): In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL…
CVE-2024-6670 — Critical (CVSS 9.8): In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to…
CVE-2024-4885 — Critical (CVSS 9.8): In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress…
CVE-2024-4884 — Critical (CVSS 9.8): In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress…

All CVEs affecting Progress Whatsup Gold →

Other CWE-16 vulnerabilities

CVE-2013-4316 — Critical (CVSS 10.0): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack…
CVE-2013-1221 — Critical (CVSS 10.0): The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not…
CVE-2011-4501 — Critical (CVSS 10.0): The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg,…
CVE-2010-4586 — Critical (CVSS 10.0): The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and…
CVE-2010-2977 — Critical (CVSS 10.0): Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not properly implement TLS and SSL, which has…
CVE-2010-2276 — Critical (CVSS 10.0): The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2,…

Browse all CWE-16 vulnerabilities →