CVE-2026-65941: WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-12 · updated 2026-10-24
Weakness: CWE-73

Description

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

Affected products

Progress Software Corporation WhatsUp Gold: before 26.0.2 — fixed in 26.0.2

How to fix

Upgrade to a fixed version: Progress Software Corporation WhatsUp Gold 26.0.2. Check the vendor advisory for mitigations.

References

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026
https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html
https://www.progress.com/network-monitoring

Get alerted when CVE-2026-65941 or the next vulnerability affects your stack