What is the CVSS score of CVE-2026-65940?

CVE-2026-65940 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-65940?

Yes, a patch is available for CVE-2026-65940. Update the affected software to the latest version immediately.

WhatsUp Gold CVE-2026-65940

EUVD-2026-57266 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-08-12 ProgressSoftware

GHSA-wrx3-m3pw-xfmv

Information Disclosure Whatsup Gold Progress Software Corporation

6.8

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

6.8 MEDIUM

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

AV:A reflects internal management network deployment; PR:H matches the explicit 'privileged attacker' prerequisite; full C/I/A impact from arbitrary file write enabling web shell execution on the host.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 16:13 vuln.today

Patch available

Aug 12, 2026 - 16:02 EUVD

DescriptionCVE.org

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

AnalysisAI

Arbitrary file write in Progress Software's WhatsUp Gold (all versions before 2026.0.2) enables a privileged attacker with adjacent network access to place attacker-controlled files in web-accessible directories on the host server - a primitive that commonly leads to web shell deployment and subsequent unauthenticated remote code execution via HTTP. Exploitation is constrained by both a high-privilege credential requirement and an adjacent-network attack vector (CVSS:3.1/AV:A/PR:H), substantially narrowing the practical attack surface compared to the full C:H/I:H/A:H impact triad would suggest. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is confirmed available in version 2026.0.2.

Technical ContextAI

WhatsUp Gold (CPE: cpe:2.3:a:progress_software_corporation:whatsup_gold) is a network monitoring and management platform by Progress Software Corporation, typically deployed on Windows servers within enterprise management network segments. The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): the application fails to enforce appropriate filesystem access controls on write operations performed by privileged accounts, allowing attacker-controlled file content to be placed in directories served by the embedded web component. Because the destination directories are web-accessible, a file written there can subsequently be retrieved and executed via HTTP without further authentication - a classic server-side file write to web root pattern that is routinely weaponized through web shell deployment. The adjacency requirement reflected in AV:A is consistent with WhatsUp Gold's typical deployment on dedicated internal management VLANs rather than internet-facing infrastructure.

RemediationAI

The primary fix is upgrading WhatsUp Gold to version 2026.0.2 or later, as confirmed by the vendor's August 2026 Security Bulletin (https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026) and the 2026.0 Release Notes (https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html). If immediate patching is not feasible, compensating controls should address both prerequisite conditions inherent to the vulnerability: enforce multi-factor authentication and apply least-privilege principles to all WhatsUp Gold administrative accounts, since the PR:H requirement means an attacker must first hold or steal high-privilege credentials - hardening credential security directly raises the exploitation bar. Additionally, isolate the WhatsUp Gold host on a dedicated management VLAN accessible only from authorized administrator workstations, reinforcing the existing adjacent-network constraint (AV:A) through network segmentation controls; this limits which compromised internal hosts could be used as a launch point. Neither workaround eliminates the vulnerability - they reduce the probability that an attacker can satisfy the prerequisites. Configuring filesystem integrity monitoring on web-accessible directories of the WhatsUp Gold installation provides a detection control if exploitation is attempted.