Progress SoftwareCVE-2026-65941

Progress Software WhatsUp Gold: remote code execution

High8.8CVE-2026-65941 · Published Aug 12, 2026 · updated Sep 2, 2026

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

Progress Software advisory

Affected versions

Package	Affected	Fixed in
WhatsUp Gold Product	< 26.0.2	26.0.2

Details and references

CVSS 3.1: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-73, CWE-94, CWE-306, CWE-918

More Progress Software advisories

All Progress Software

Date	Advisory	Severity	Fixed in
Aug 17	Progress Software ShareFile Storage Zones Controller: remote code execution High7.2Aug 17 CVE-2026-16139No fix yet	High7.2	No fix yet
Aug 17	Progress Software ShareFile Storage Zones Controller: unsafe deserialization High8.0Aug 17 CVE-2026-16138No fix yet	High8.0	No fix yet
Aug 12	Progress Software WhatsUp Gold: cross-site scripting High8.0Aug 12 CVE-2026-6593726.0.2	High8.0	26.0.2
Aug 12	Progress Software WhatsUp Gold: improper authorization Medium4.3Aug 12 CVE-2026-6593826.0.2	Medium4.3	26.0.2
Aug 12	Progress Software WhatsUp Gold: path traversal Medium6.8Aug 12 CVE-2026-6593926.0.2	Medium6.8	26.0.2
Aug 12	Progress Software WhatsUp Gold: insecure default permissions Medium6.8Aug 12 CVE-2026-6594026.0.2	Medium6.8	26.0.2

Affected versions

More Progress Software advisories

Critical advisories by email