CVE-2026-65941

HIGH 8.8

WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

CWE	CWE-306 CWE-918 CWE-73 CWE-94
Vendor	progress software corporation
Product	whatsup gold
Published	Aug 12, 2026
Last Updated	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for progress software corporation whatsup gold

Be the first to know when new high vulnerabilities affecting progress software corporation whatsup gold are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Progress Software Corporation / WhatsUp Gold

0 < 26.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

progress.com: https://www.progress.com/network-monitoring docs.progress.com: https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html community.progress.com: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026

Credits

Dany Bach from Airbus Security Lab