Progress Software issued an emergency advisory urging administrators to remediate six vulnerabilities affecting the WhatsUp Gold network monitoring platform, headlined by critical remote code execution defects tracked as CVE-2026-8785 and CVE-2026-46909 (both CVSS 9.8). The primary flaw, CVE-2026-8785, resides within NmAPI.exe, a Windows Communication Foundation (WCF) service listening unauthenticated on TCP port 9643. Remote adversaries invoke the exposed UpdateFailoverRegistryValues method without authorization, altering registry values under HKLM\SOFTWARE\WOW6432Node\Ipswitch\. By overriding InstallDir with an attacker-controlled SMB share path, threat actors force the privileged Ipswitch Service Control Manager to load malicious configuration files upon restart, executing arbitrary code with NT AUTHORITY\SYSTEM privileges.

The second critical defect, CVE-2026-46909, allows unauthenticated arbitrary file writes via the WriteDataFile API method, enabling direct payload deployment. Four accompanying SQL injection flaws (CVE-2026-46905 through CVE-2026-46908, CVSS 8.8) allow authenticated operators to escalate to administrative privileges. While reported via coordinated disclosure by Tenable and Summoning Team researchers, exposed network monitoring tools face rapid opportunistic weaponization. Progress released WhatsUp Gold 24.0.1 to remediate all six flaws, advising operators to update immediately.

Why it matters:

• Technical & Architecture Risk: Unauthenticated WCF service endpoints listening on exposed ports allow attackers to alter critical registry settings, pivoting from network discovery services directly to arbitrary code execution with highest-level SYSTEM privileges without tripping endpoint detection.
• Strategic & Defender Imperative: Defenders must immediately upgrade WhatsUp Gold to version 24.0.1, restrict inbound access to TCP port 9643, and inspect registry paths under HKLM\SOFTWARE\WOW6432Node\Ipswitch\ for unauthorized UNC modifications or remote binary redirects.