WhatsUp Gold CVE-2026-65938

Exploitation requires a valid authenticated session in WhatsUp Gold - any user account, regardless of assigned privilege level, is sufficient. The CVSS adjacent network vector (AV:A) indicates the attacker must have network-adjacent access to the WhatsUp Gold server, which constrains exploitation to users already inside the internal network or connected via VPN. The vulnerability is specific to the Scheduled Reports API; other application endpoints are not confirmed affected. Exploitation is bounded by the need for valid credentials: unauthenticated external attackers cannot exploit this vulnerability without first obtaining a WhatsUp Gold account through a separate attack, such as credential theft or brute force. No special configuration, feature flag, or non-default deployment mode is required beyond having an active user account.

The provided CVSS vector (AV:A/AC:L/PR:N/UI:N) contains a notable internal inconsistency: PR:N indicates no authentication is required, yet the CVE description explicitly states exploitation is possible only for 'any authenticated user.' This discrepancy is not resolved in the available references and should be verified with the vendor - the practical attack requires a valid credential, making PR:L the more accurate representation. The adjacent network vector (AV:A) reflects WhatsUp Gold's typical internal deployment posture, which limits exposure to users already inside the network perimeter, consistent with its role as an internal IT operations tool. There is no CISA KEV listing and no known public proof-of-concept, meaning exploitation pressure is currently low. EPSS data was not provided. The integrity impact is rated Low (I:L), indicating the ability to invoke restricted API actions rather than full administrative takeover. Overall, this is a moderate-priority issue: the authentication prerequisite and internal deployment model constrain real-world risk, though any environment where untrusted users hold WhatsUp Gold accounts - such as a large IT team with mixed privilege tiers - faces meaningful exposure from insider or compromised-credential scenarios.

An attacker holding any low-privileged WhatsUp Gold user account - such as a read-only monitoring user or a recently onboarded network operator - crafts a direct API request to the Scheduled Reports endpoint targeting a restricted action, such as modifying or deleting another user's report schedule or invoking an administrative report operation. Because the API validates only the session token and not the caller's role, the request succeeds. No public exploit code has been identified at time of analysis, but exploitation requires only valid credentials and familiarity with the API structure, which may be inferred from product documentation or intercepted traffic.