What is the CVSS score of CVE-2026-65941?

CVE-2026-65941 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WhatsUp Gold are affected by CVE-2026-65941?

Progress Software WhatsUp Gold versions prior to 2026.0.2 contain an unauthenticated remote code execution vulnerability affecting all current deployments on network-adjacent segments.. A patch is available.

How to fix or mitigate CVE-2026-65941?

Within 24 hours, inventory all WhatsUp Gold deployments and implement network access restrictions to the application; limit connectivity to authorized monitoring systems and IT personnel only. Within 7 days, deploy vendor patch version 2026.0.2 to all affected systems, prioritizing production monitoring infrastructure. Within 30 days, verify all instances have been upgraded to version 2026.0.2 or later, review access and execution logs for indicators of compromise, and validate network segmentation controls are enforced.

WhatsUp Gold CVE-2026-65941

EUVD-2026-57267 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-12 ProgressSoftware

GHSA-5f38-j7h2-22q2

Authentication Bypass RCE Whatsup Gold Progress Software Corporation

8.8

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

AV:A retained as WhatsUp Gold is an internal monitoring service; PR:N confirmed by unauthenticated exploitation per CWE-306; full C/I/A warranted given code execution as IIS service account.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 16:06 vuln.today

Patch available

Aug 12, 2026 - 16:02 EUVD

CVE Published

Aug 12, 2026 - 15:23 cve.org

HIGH 8.8

DescriptionCVE.org

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

AnalysisAI

Remote code execution in Progress Software WhatsUp Gold (all versions before 2026.0.2) allows unauthenticated attackers with adjacent network access to invoke a critical function exposed without authentication (CWE-306), executing arbitrary code as the IIS application service account. The CVSS 3.1 score of 8.8 with PR:N and UI:N confirms zero-credential, zero-interaction exploitation against all pre-patch deployments. No public exploit has been identified at time of analysis, but a vendor patch is available in version 2026.0.2 per the August 2026 security bulletin.

Technical ContextAI

WhatsUp Gold is a network infrastructure monitoring platform by Progress Software Corporation, delivered as an IIS-hosted web application on Windows Server. The CPE string cpe:2.3:a:progress_software_corporation:whatsup_gold:*:*:*:*:*:*:*:* encompasses all versions before 2026.0.2. The root cause is CWE-306 (Missing Authentication for Critical Function): one or more endpoints capable of triggering code execution are reachable without any credential check. Because WhatsUp Gold runs under an IIS application service account, the execution context typically carries elevated OS-level privileges within the server environment and has broad visibility into monitored network infrastructure, credentials, and device configurations stored by the monitoring platform.

RemediationAI

Upgrade WhatsUp Gold to version 2026.0.2 or later immediately; this is the vendor-released patch confirmed in the August 2026 security bulletin at https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026 and detailed in the release notes at https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html. For environments where patching cannot be applied immediately, restrict network access to the WhatsUp Gold server using host-based Windows Firewall rules or upstream network ACLs, permitting inbound connections only from explicitly authorized administrator workstations and monitoring-consumer systems - this directly shrinks the adjacent-network attack surface and is the most impactful compensating control given the AV:A vector. If the WhatsUp Gold interface is reachable from broad internal segments or through VPN tunnels without further segmentation, relocate it to a dedicated management VLAN with strict ingress filtering as an interim measure. Note that network segmentation reduces but does not eliminate risk, since any legitimately-permitted host could still serve as a pivot point for an authenticated internal attacker.