Vulnerability · Published Aug 12, 2026 · Assigned by ProgressSoftware
CVE-2026-65941WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
High 8.8
In plain English
A high-severity missing authentication in WhatsUp Gold from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 47.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | WhatsUp Gold | 0 – before 26.0.2 |
Weakness: CWE-306, CWE-918, CWE-73, CWE-94 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H