Critical · 9.8 CVE-2026-65941 EUVD-2026-57267GHSA-5f38-j7h2-22q2

WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

Published Aug 12, 2026 · Updated Nov 6, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: WhatsUp Gold

Description

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

Affected products

Vendor	Product	Affected	Fixed
Progress Software	WhatsUp Gold	< 26.0.2	26.0.2

References

https://www.progress.com/network-monitoring
https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html release-notes
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026 vendor-advisory