WhatsUp Gold CVE-2026-65941

Attackers must have adjacent network access to the WhatsUp Gold server - the CVSS AV:A metric means they must be on the same network segment, VLAN, or directly routed subnet; internet-based exploitation requires a prior pivot (e.g., compromised VPN client, phished internal host). Once adjacent, no credentials, configuration changes, specific enabled features, or user interaction are required (PR:N, UI:N, AC:L) - the missing authentication affects a core platform function present in all deployments before 2026.0.2. Exploitation is limited by: (1) adjacency requirement, which blocks direct internet exploitation; (2) the need for IP-layer reachability to the IIS port; (3) the execution context is the IIS service account rather than SYSTEM, though this still typically yields significant privilege in practice.

The CVSS 3.1 vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.8 and reflects a low-complexity, zero-authentication exploit path, tempered by an Adjacent network vector (AV:A). That adjacency requirement is the primary mitigating signal: casual internet-based mass exploitation is not directly possible without first obtaining a foothold in the target network segment. However, enterprise deployments of WhatsUp Gold are frequently reachable from broad internal VLANs, management networks, and VPN-connected endpoints, meaning the practical attack surface is wider than AV:A alone implies. No EPSS score or CISA KEV listing was present in the available data, so exploitation probability cannot be numerically quantified; the absence of a KEV entry means confirmed active exploitation is unknown, not ruled out. The Authentication Bypass and RCE tags, combined with PR:N and CWE-306, indicate a straightforward exploit path for any adjacent attacker - this is a genuine remediation priority for organizations running WhatsUp Gold on internal monitoring segments, not a low-real-risk, high-CVSS paper vulnerability.

An attacker positioned on the same network segment as the WhatsUp Gold server - whether through direct internal access, a VPN connection, or a previously compromised internal host - sends a crafted unauthenticated HTTP request to the vulnerable IIS-hosted endpoint that lacks authentication enforcement (CWE-306). The application processes the request and executes attacker-supplied code in the context of the IIS application service account, granting shell access or equivalent command execution on the server. From this foothold the attacker can exfiltrate stored network credentials, SNMP community strings, and device configurations for all monitored infrastructure.