How to check if you are exposed to CVE-2024-6670
- Find every Progress WhatsUp Gold system you or your clients run, including ones exposed to the internet. Those come first: CISA only lists flaws attackers are already using.
- Compare each version with the fixed versions in the vendor advisory below. Where no fix exists yet, apply the vendor’s mitigation or take the system off the internet.
- Run a credentialed vulnerability scan to catch the systems you missed, then check that the next scan no longer reports CVE-2024-6670.
US federal agencies had to fix this by 2024-10-07. Everyone else should treat that deadline as a guide: if it has passed, this is overdue.
Timeline
- · Added to CISA's Known Exploited Vulnerabilities catalog
- · Fix-by date for US federal agencies, passed 755 days ago
Vendor advisories and fixes
Weakness type
More exploited Progress vulnerabilities
CISA lists 9 exploited Progress vulnerabilities. The closest matches:
- CVE-2024-4885Progress WhatsUp Gold Path Traversal VulnerabilityAdded 2025-03-03
- CVE-2026-8037Progress LoadMaster Command Injection VulnerabilityAdded 2026-08-07
- CVE-2024-1212Progress Kemp LoadMaster OS Command Injection VulnerabilityAdded 2024-11-18
- CVE-2024-4358Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityAdded 2024-06-13
- CVE-2023-40044Progress WS_FTP Server Deserialization of Untrusted Data VulnerabilityAdded 2023-10-05
- CVE-2023-34362Progress MOVEit Transfer SQL Injection VulnerabilityAdded 2023-06-02
- CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data VulnerabilityAdded 2021-11-03
- CVE-2017-9248Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness VulnerabilityAdded 2021-11-03
Keep going
Sources: CISA Known Exploited Vulnerabilities catalog (version 2026.10.30); EPSS data from FIRST.org; CVSS and descriptions from the NIST National Vulnerability Database. Checked 2026-11-01. This product uses the NVD API but is not endorsed or certified by the NVD.