CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026	Vendor Advisory
https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html	Release Notes
https://www.progress.com/network-monitoring	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En versiones de WhatsUp Gold lanzadas antes de 2026.0.2, un atacante remoto no autenticado con acceso de red al servicio afectado puede ejecutar código arbitrario en el contexto de la cuenta de servicio de aplicación de IIS.

Information

Published : 2026-08-12 16:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-65941

Mitre link : CVE-2026-65941

CVE.ORG link : CVE-2026-65941

JSON object : View

Products Affected

progress

whatsup_gold

CWE

CWE-73

External Control of File Name or Path

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-306

Missing Authentication for Critical Function

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-65941", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65941", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T16:10:17.382233Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software Corporation", "product": "WhatsUp Gold", "versions": [{"status": "affected", "version": "0", "lessThan": "26.0.2", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T16:17:14.050", "references": [{"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026", "tags": ["Vendor Advisory"], "source": "security@progress.com"}, {"url": "https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html", "tags": ["Release Notes"], "source": "security@progress.com"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In WhatsUp Gold versions released before 2026.0.2,\u00a0an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account."}, {"lang": "es", "value": "En versiones de WhatsUp Gold lanzadas antes de 2026.0.2, un atacante remoto no autenticado con acceso de red al servicio afectado puede ejecutar c\u00f3digo arbitrario en el contexto de la cuenta de servicio de aplicaci\u00f3n de IIS."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47C4FCAC-F2EA-448F-938C-50089809863A", "versionEndExcluding": "26.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}