AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-65941

Progress Software WhatsUp Gold: remote code execution

Progress Software

CVE-2026-65941 · Published Aug 12, 2026 · updated Nov 6, 2026

Critical9.8
Fix: upgrade to 26.0.2 or later
Progress Software advisory

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

Affected versions

PackageAffectedFixed in
WhatsUp Gold
Product
< 26.0.226.0.2

Changes since it was listed

CVSS scoreNov 7CVSS score: 8.8 to 9.8
SeverityNov 7Severity: High to Critical
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-73, CWE-94, CWE-306, CWE-918

More Progress Software advisories

All Progress Software
High 7.2Aug 17Progress Software ShareFile Storage Zones Controller: remote code executionCVE-2026-16139no fix yetHigh 8.0Aug 17Progress Software ShareFile Storage Zones Controller: unsafe deserializationCVE-2026-16138no fix yetHigh 8.0Aug 12Progress Software WhatsUp Gold: cross-site scriptingCVE-2026-65937fixed in 26.0.2Medium 4.3Aug 12Progress Software WhatsUp Gold: improper authorizationCVE-2026-65938fixed in 26.0.2Medium 6.8Aug 12Progress Software WhatsUp Gold: path traversalCVE-2026-65939fixed in 26.0.2Medium 6.8Aug 12Progress Software WhatsUp Gold: insecure default permissionsCVE-2026-65940fixed in 26.0.2