CVE-2026-65941

{
  "id": "CVE-2026-65941",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T16:17:14.050",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account."
    },
    {
      "lang": "es",
      "value": "En versiones de WhatsUp Gold lanzadas antes de 2026.0.2, un atacante remoto no autenticado con acceso de red al servicio afectado puede ejecutar código arbitrario en el contexto de la cuenta de servicio de aplicación de IIS."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Progress Software Corporation",
          "product": "WhatsUp Gold",
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "26.0.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T16:10:17.382233Z",
          "id": "CVE-2026-65941",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "26.0.2",
              "matchCriteriaId": "47C4FCAC-F2EA-448F-938C-50089809863A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://www.progress.com/network-monitoring",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}