What is the CVSS score of CVE-2026-65939?

CVE-2026-65939 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-65939?

Yes, a patch is available for CVE-2026-65939. Update the affected software to the latest version immediately.

WhatsUp Gold CVE-2026-65939

EUVD-2026-57264 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-12 ProgressSoftware

GHSA-j337-6rqp-7m54

File Upload Whatsup Gold Progress Software Corporation

6.8

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

6.8 MEDIUM

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

AV:A reflects on-premises IIS network monitoring deployment; PR:H confirmed by explicit 'privileged attacker' requirement; full CIA impact from web shell placement enabling RCE under IIS service account.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 16:12 vuln.today

Patch available

Aug 12, 2026 - 16:02 EUVD

DescriptionCVE.org

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

AnalysisAI

WhatsUp Gold versions before 2026.0.2 allow a privileged attacker to configure a LogToFile action with an arbitrary file extension, enabling placement of server-executable files (e.g., .aspx web shells) directly within the IIS web root directory. Progress Software confirmed the issue and released a patch in version 2026.0.2, documented in the August 2026 security bulletin. No public exploit code has been identified at time of analysis, but the high CIA impact combined with the adjacent-network vector makes this a material insider threat and post-compromise persistence risk.

Technical ContextAI

WhatsUp Gold (CPE: cpe:2.3:a:progress_software_corporation:whatsup_gold:*:*:*:*:*:*:*:*) is a network monitoring platform by Progress Software Corporation that runs hosted on Microsoft IIS. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type): the application permits privileged users to define LogToFile actions without enforcing restrictions on the output file extension. Because the target write path falls within the IIS web root, an attacker can produce files bearing server-executable extensions such as .aspx, .asp, or .ashx that IIS will subsequently parse and execute as server-side code. This is a well-understood arbitrary-file-write-to-web-shell escalation pattern in enterprise web applications hosted on IIS, and it bypasses traditional file upload controls by routing through a logging configuration interface rather than a direct upload endpoint.

RemediationAI

Upgrade WhatsUp Gold to version 2026.0.2 or later, as documented in the Progress Software August 2026 security bulletin at https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026. Where immediate patching is not feasible, apply compensating controls: restrict access to LogToFile action configuration to the minimum required administrative accounts, and implement file system monitoring (e.g., Windows File System Auditing or a SIEM rule) on the IIS web root directories to alert on creation of files bearing executable extensions such as .aspx, .asp, .ashx, and .asmx. Enabling IIS request filtering to block execution of unexpected script-mapped file types in the WhatsUp Gold application directories would limit the impact if a web shell is placed, though it does not prevent the file write itself. These compensating controls reduce blast radius but do not eliminate the vulnerability; upgrading to 2026.0.2 remains the definitive remediation.