CVEvulnerability

CVE-2026-65941

8.8 HIGH Published 2026-08-12 Modified 2026-10-24 Official page ↗

Status: Analyzed
Published: 2026-08-12
Last modified: 2026-10-24
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-306, CWE-73, CWE-918, CWE-94

Description

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

Affected configurations

• progress whatsup gold (< 26.0.2)

Weakness · CWE (4)

CWE-306 Missing Authentication for Critical Functionality weakness
CWE-73 External Control of File Name or Path weakness
CWE-918 Server-Side Request Forgery weakness
CWE-94 Improper Control of Generation of Code weakness

References

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026 Vendor Advisory
https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html Release Notes
https://www.progress.com/network-monitoring Product

CVE-2026-65941

Description

Affected configurations

Related

Weakness · CWE (4)

References