What is the CVSS score of CVE-2026-65937?

CVE-2026-65937 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WhatsUp Gold are affected by CVE-2026-65937?

Progress Software's WhatsUp Gold network monitoring platform contains a vulnerability that could allow internal network users to compromise administrator accounts and manipulate network threat…. A patch is available.

How to fix or mitigate CVE-2026-65937?

Within 24 hours, verify all deployed WhatsUp Gold instances and document administrative users with access to each system. Within 7 days, upgrade all WhatsUp Gold installations to version 2026.0.2 or later, prioritizing systems accessed by network administrators. Complete remediation of all instances within 30 days and conduct a 90-day security review of administrator account activity logs to identify any unauthorized access or configuration changes.

WhatsUp Gold CVE-2026-65937

EUVD-2026-57262 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-12 ProgressSoftware

GHSA-c9r8-v9c2-r47m

XSS Whatsup Gold Progress Software Corporation

8.0

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

PR:L applied because description explicitly requires authentication; AV:A retained as network monitoring tools are typically adjacent-only; C/I/A:H reflects admin account takeover potential.

3.1 AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 16:04 vuln.today

Patch available

Aug 12, 2026 - 16:02 EUVD

CVE Published

Aug 12, 2026 - 15:21 cve.org

HIGH 8.0

DescriptionCVE.org

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

AnalysisAI

Persistent cross-site scripting in Progress Software's WhatsUp Gold network monitoring platform (all versions before 2026.0.2) allows an authenticated attacker on an adjacent network to bypass frontend input sanitization controls and inject stored malicious script content into the application. When a victim user - likely an administrator - views the poisoned page, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions with the victim's privilege level. No public exploit identified at time of analysis, and the adjacent-network attack vector limits internet-scale exposure, but the high C/I/A impact scores reflect the sensitivity of network monitoring credentials.

Technical ContextAI

WhatsUp Gold (CPE: cpe:2.3:a:progress_software_corporation:whatsup_gold:*:*:*:*:*:*:*:*) is a network monitoring and management web application developed by Progress Software Corporation. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored (persistent) variant. The root cause is inadequate server-side sanitization of attacker-controlled input before it is re-rendered in the browser, combined with insufficient frontend controls that can be bypassed. Because WhatsUp Gold's web UI is used by network operations staff with broad visibility into infrastructure topology, credentials, and device configurations, XSS payloads in this context carry elevated lateral-movement and privilege-escalation potential compared to lower-sensitivity web applications.

RemediationAI

Upgrade to WhatsUp Gold 2026.0.2 or later, as confirmed by the Progress Software security bulletin at https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026 and the release notes at https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html. Vendor-released patch: 2026.0.2. If immediate patching is not possible, restrict access to the WhatsUp Gold web interface to trusted administrators only via firewall ACLs or VPN, limiting the pool of authenticated users who could inject malicious content. Additionally, enforce Content-Security-Policy headers at the reverse proxy layer to constrain script execution origins, though this is a compensating control - it may break application functionality and does not address the underlying injection flaw. Monitor web application logs for anomalous script-like strings in input fields as a detection measure.