Progress SoftwareCVE-2026-65937

Progress Software WhatsUp Gold: cross-site scripting

High8.0CVE-2026-65937 · Published Aug 12, 2026 · updated Sep 2, 2026

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

Progress Software advisory

Affected versions

Package	Affected	Fixed in
WhatsUp Gold Product	< 26.0.2	26.0.2

Details and references

CVSS 3.1: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79, CWE-94

More Progress Software advisories

All Progress Software

Date	Advisory	Severity	Fixed in
Aug 17	Progress Software ShareFile Storage Zones Controller: remote code execution High7.2Aug 17 CVE-2026-16139No fix yet	High7.2	No fix yet
Aug 17	Progress Software ShareFile Storage Zones Controller: unsafe deserialization High8.0Aug 17 CVE-2026-16138No fix yet	High8.0	No fix yet
Aug 12	Progress Software WhatsUp Gold: remote code execution High8.8Aug 12 CVE-2026-6594126.0.2	High8.8	26.0.2
Aug 12	Progress Software WhatsUp Gold: improper authorization Medium4.3Aug 12 CVE-2026-6593826.0.2	Medium4.3	26.0.2
Aug 12	Progress Software WhatsUp Gold: path traversal Medium6.8Aug 12 CVE-2026-6593926.0.2	Medium6.8	26.0.2
Aug 12	Progress Software WhatsUp Gold: insecure default permissions Medium6.8Aug 12 CVE-2026-6594026.0.2	Medium6.8	26.0.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.