CVE-2026-65940: 
WhatsUp Gold vulnerability analysis and mitigation

CVE-2026-65940 is an arbitrary file write vulnerability in Progress Software's WhatsUp Gold network monitoring software affecting all versions released before 2026.0.2. A privileged attacker with adjacent network access can write arbitrary files to a web-accessible location on the host server. The vulnerability was published on August 12, 2026, and patched in version 2026.0.2 released the same day. It carries a CVSS v3.1 base score of 6.8 (Medium) (Github Advisory, Progress Release Notes).

The vulnerability is classified under CWE-276 (Incorrect Default Permissions) and CWE-732 (Incorrect Permission Assignment for Critical Resource), indicating that file or directory permissions are misconfigured in a way that allows a privileged user to write files outside of intended boundaries into web-accessible directories (Github Advisory). Exploitation requires the attacker to already hold high privileges within the WhatsUp Gold application and have adjacent network access to the server — meaning the attack cannot be launched directly from the internet without first gaining a foothold on the same network segment. The attack complexity is low and no user interaction is required once the preconditions are met. No public proof-of-concept code has been identified at this time (Github Advisory).

A successful exploit allows a high-privileged attacker to write arbitrary files — such as web shells or malicious scripts — to web-accessible directories on the WhatsUp Gold server, potentially enabling remote code execution or delivery of malicious content to users accessing the web interface. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability, meaning a fully compromised WhatsUp Gold server could expose sensitive network monitoring data, allow persistent backdoor access, and disrupt monitoring operations (Github Advisory). Given WhatsUp Gold's role as a network monitoring platform with broad visibility into infrastructure, a compromised instance could facilitate lateral movement across the monitored environment.

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.211%, placing it in the 12th percentile for exploitation likelihood within the next 30 days. The NVD SSVC assessment also indicates no known exploitation. Exploitation is constrained by the requirement for high privileges and adjacent network access, reducing the overall risk compared to unauthenticated remote vulnerabilities.

• File System: Unexpected or newly created files (e.g., .aspx, .php, .html) in web-accessible directories of the WhatsUp Gold installation (typically under the IIS web root or WhatsUp Gold web application folder).
• Logs: IIS access logs showing unusual POST or PUT requests to administrative endpoints resulting in file creation; application event logs recording file write operations by the WhatsUp Gold service account to web directories.
• Process: Unexpected child processes spawned from the IIS worker process (w3wp.exe) or WhatsUp Gold service processes, such as cmd.exe, powershell.exe, or network utilities.
• Network: Outbound connections from the WhatsUp Gold server to unknown external IP addresses, particularly following access to newly written web-accessible files.

Progress Software has released WhatsUp Gold version 2026.0.2 (released August 12, 2026) which addresses CVE-2026-65940 along with several other security issues (Progress Release Notes). Organizations should upgrade to version 2026.0.2 or later as the primary remediation step. As interim mitigations, restrict network access to the WhatsUp Gold server to trusted administrative networks only, implement network segmentation to limit adjacent network exposure, and monitor web-accessible directories for unauthorized file modifications (Github Advisory).

Progress Software disclosed the vulnerability via a security bulletin on the Progress Community portal and included the fix in the 2026.0.2 release notes alongside five other CVEs patched in the same update (Progress Release Notes). No notable independent researcher commentary or significant social media discussion has been identified at this time.