CVE-2026-65941

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026	Vendor Advisory
https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html	Release Notes
https://www.progress.com/network-monitoring	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-08-12 16:17

Updated : 2026-09-02 18:25

NVD link : CVE-2026-65941

Mitre link : CVE-2026-65941

CVE.ORG link : CVE-2026-65941

JSON object : View

Products Affected

progress

whatsup_gold

CWE

CWE-73

External Control of File Name or Path

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-306

Missing Authentication for Critical Function

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-65941", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65941", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T16:10:17.382233Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software Corporation", "product": "WhatsUp Gold", "versions": [{"status": "affected", "version": "0", "lessThan": "26.0.2", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T16:17:14.050", "references": [{"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026", "tags": ["Vendor Advisory"], "source": "security@progress.com"}, {"url": "https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html", "tags": ["Release Notes"], "source": "security@progress.com"}, {"url": "https://www.progress.com/network-monitoring", "tags": ["Product"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In WhatsUp Gold versions released before 2026.0.2,\u00a0an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account."}], "lastModified": "2026-09-02T18:25:50.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47C4FCAC-F2EA-448F-938C-50089809863A", "versionEndExcluding": "26.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}