Advantive VeraCore Unrestricted File Upload Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2024-57968 · Published 03/02/2025 · updated 17/06/2026

Advantive VeraCore Unrestricted File Upload Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/03/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
veracore advantive	`< 2024.4.2.1`	`2024.4.2.1`

Description

Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.

References

advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1 · Permissions Required
intezer.com/blog/research/xe-group-exploiting-zero-days · Exploit
solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2024-57968

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free