Loading story…
Progress WhatsUp Gold contained four vulnerabilities that could be chained from unauthenticated access to disclosure of application users’ plaintext passwords, arbitrary local-file reads, and capture of the server’s Net-NTLMv2 hash. The chain used CVE-2022-29847, a blind SSRF in report rendering that transmitted usernames and encrypted passwords to an attacker-controlled host, together with CVE-2022-29846, which exposed the pre-authentication product serial number used as the credential-encryption salt.
An attacker could use the exposed serial number to decrypt captured credentials, authenticate to the application, and exploit CVE-2022-29845 directory traversal to read local files or trigger outbound SMB authentication. The authenticated CVE-2022-29848 WebContent SSRF could also leak the Windows host’s Net-NTLMv2 hash. Progress received the vulnerability report on April 11, 2022, provided a patched build on April 28, and researchers confirmed remediation of all four flaws on May 11.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The researchers confirmed that Progress had fixed all four reported WhatsUp Gold vulnerabilities.
Progress provided the researchers with a patched WhatsUp Gold version for validation of the reported vulnerabilities.
Researchers disclosed four vulnerabilities in Progress WhatsUp Gold, including pre-authentication SSRF and serial-number exposure plus authenticated local-file disclosure and SSRF, which could be chained to recover credentials, read local files, and capture Net-NTLMv2 hashes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Progress Software disclosed five high-severity vulnerabilities affecting **LoadMaster**, **ECS Connection Manager**, **Connection Manager for ObjectScale**, **MOVEit WAF**, and, for one issue, **Multi-Tenant LoadMaster**. The flaws, tracked as `CVE-2026-59686` through `CVE-2026-59690`, include three authenticated OS command injection bugs and two authorization failures. `CVE-2026-59689` can let a low-privileged authenticated user escalate to **root**, while `CVE-2026-59690` allows unauthorized administrative actions through the **REST API**; the command injection issues (`CVE-2026-59686`, `CVE-2026-59687`, and `CVE-2026-59688`) affect the management interface, Geo Location management interface, and backup restore functionality, respectively. Progress said it has **no reports of active exploitation**, **no known direct customer impact**, and **no indicators of compromise** so far, but warned that successful exploitation could lead to full appliance compromise. The vulnerabilities carry **CVSS 3.1 scores of 8.0 to 8.4**, affect older product releases, and require authentication, prompting the vendor to urge immediate upgrades to fixed versions. Defenders are advised to tighten privileged account access, enforce strong authentication controls such as MFA where available, and closely monitor management interfaces and REST API activity for suspicious behavior.
Jul 29, 2026
Researchers reported that **CVE-2025-59214** is a zero-click Windows NTLM credential-leakage flaw that bypasses prior mitigations for **CVE-2025-24054** and **CVE-2025-50154**. A crafted shortcut can cause Windows Explorer to automatically authenticate to an attacker-controlled UNC/SMB endpoint, disclosing an NTLMv2-SSP hash without requiring victim interaction; the issue was reportedly reproduced on a fully updated Windows Server 2022 system with `KB5063880` installed. The leak stems from inconsistent validation of shortcut fields: Explorer checks icon paths but can process a UNC target path through an alternate existence-check path that initiates NTLM authentication. Attackers could crack captured hashes offline or relay them to other services, creating paths to unauthorized access, privilege escalation, lateral movement, or remote code execution depending on the exposed account and environment. Earlier reporting documented exploitation of CVE-2025-24054 in the wild, underscoring the operational risk of NTLM coercion through malicious Windows shortcut content.
Sep 3, 2026
Microsoft Defender researchers reported a multi-stage intrusion campaign exploiting **internet-exposed SolarWinds Web Help Desk (WHD)** servers to establish stealthy persistence and enable lateral movement toward broader domain compromise. After initial access, attackers created a scheduled task to start a hidden **QEMU** virtual machine under `SYSTEM`, using QEMU port forwarding (e.g., `hostfwd=tcp::22022-:22`) to provide a concealed SSH access path. The activity also included credential-theft tradecraft via **DLL sideloading**, abusing `wab.exe` to load a malicious `sspicli.dll`, enabling access to **LSASS** memory while attempting to evade common detections. Separately, active exploitation was reported against **Ivanti Endpoint Manager Mobile (EPMM)** appliances following disclosure of two critical flaws—**CVE-2026-1281** (authentication bypass) and **CVE-2026-1340** (remote code execution)—with intrusions observed dropping an artifact at `/mifs/403.jsp`. The observed payloads differed from typical interactive webshells: attackers delivered a Base64-encoded Java class (with `CAFEBABE` header) acting as a **dormant in-memory class loader** (e.g., `base.Info` compiled from `Info.java`) that waits for a later activation request to load and execute a second-stage class in memory, including an unusual entry point using `equals(Object)` rather than standard servlet handlers. In parallel with these exploitation reports, two unrelated critical vulnerability disclosures were highlighted: **Keylime** registrar misconfiguration (**CVE-2026-1709**, CVSS 9.4) that effectively disables **mTLS client certificate enforcement** (affected versions `7.12.0`–`7.13.0`), and a **Microsoft Semantic Kernel .NET SDK** arbitrary file write (**CVE-2026-25592**, CVSS 10.0) in `SessionsPythonPlugin` (`DownloadFileAsync`/`UploadFileAsync`) that can allow overwriting files via insufficient path validation.
Jun 29, 2026