What is the CVSS score of CVE-2026-65938?

CVE-2026-65938 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-65938?

Yes, a patch is available for CVE-2026-65938. Update the affected software to the latest version immediately.

WhatsUp Gold CVE-2026-65938

EUVD-2026-57263 MEDIUM

Missing Authorization (CWE-862)

2026-08-12 ProgressSoftware

GHSA-2jfv-5vqq-f9xq

Authentication Bypass Whatsup Gold Progress Software Corporation

4.3

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Web-based API access warrants AV:N over AV:A; authenticated requirement means PR:L not PR:N; integrity-only impact reflects unauthorized action invocation without confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 16:12 vuln.today

Patch available

Aug 12, 2026 - 16:02 EUVD

DescriptionCVE.org

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.

AnalysisAI

Improper authorization in WhatsUp Gold's Scheduled Reports API allows any authenticated user to invoke actions that should be restricted to privileged roles. Affecting all versions prior to 2026.0.2, the flaw (CWE-862, Missing Authorization) means the API enforces authentication but performs no role-based access check on sensitive operations, enabling horizontal or vertical privilege escalation within the application. No public exploit has been identified at time of analysis, and a vendor-released patch is available as of version 2026.0.2.

Technical ContextAI

WhatsUp Gold (CPE: cpe:2.3:a:progress_software_corporation:whatsup_gold) is a network monitoring and management platform developed by Progress Software Corporation. Its Scheduled Reports API is an internal REST-style endpoint handling creation, modification, and management of automated report jobs. The root cause is CWE-862 (Missing Authorization): the API correctly validates that a session token exists (authentication), but fails to verify whether the authenticated user possesses the role or permission required to perform specific privileged operations. This is a classic authorization control gap common in web application APIs that implement authentication middleware without per-endpoint authorization enforcement, often arising when role-checking logic is omitted at the controller or route layer.

RemediationAI

Vendor-released patch: WhatsUp Gold 2026.0.2. Organizations should upgrade to 2026.0.2 or later immediately, following the Progress Software release notes at https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html. If immediate patching is not feasible, administrators should restrict access to the Scheduled Reports API endpoint at the network or application firewall layer, limiting which source IPs or user roles can reach the API path - this reduces exposure without breaking core monitoring functionality. Auditing existing scheduled report configurations for unauthorized changes is advisable as a post-incident hygiene step. If the Scheduled Reports feature is not actively used, disabling it entirely is a low-risk workaround, though this will prevent all automated report delivery until the patch is applied. The vendor advisory at https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026 should be consulted for any vendor-recommended interim mitigations.