AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-65939

Progress Software WhatsUp Gold: path traversal

Progress Software

CVE-2026-65939 · Published Aug 12, 2026 · updated Sep 2, 2026

Medium6.8
Fix: upgrade to 26.0.2 or later
Progress Software advisory

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

Affected versions

PackageAffectedFixed in
WhatsUp Gold
Product
< 26.0.226.0.2
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22, CWE-73, CWE-434

More Progress Software advisories

All Progress Software
High 7.2Aug 17Progress Software ShareFile Storage Zones Controller: remote code executionCVE-2026-16139no fix yetHigh 8.0Aug 17Progress Software ShareFile Storage Zones Controller: unsafe deserializationCVE-2026-16138no fix yetCritical 9.8Aug 12Progress Software WhatsUp Gold: remote code executionCVE-2026-65941fixed in 26.0.2High 8.0Aug 12Progress Software WhatsUp Gold: cross-site scriptingCVE-2026-65937fixed in 26.0.2Medium 4.3Aug 12Progress Software WhatsUp Gold: improper authorizationCVE-2026-65938fixed in 26.0.2Medium 6.8Aug 12Progress Software WhatsUp Gold: insecure default permissionsCVE-2026-65940fixed in 26.0.2