CVE-2026-65937: WhatsUp Gold XSS Vulnerability

CVE-2026-65937 Overview

CVE-2026-65937 is a stored cross-site scripting (XSS) vulnerability in Progress WhatsUp Gold versions released before 2026.0.2. An authenticated attacker on an adjacent network can bypass frontend input controls and inject persistent script content into the application. When another user loads the affected view, the injected payload executes in their browser session under the WhatsUp Gold origin. The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
A successful attack can hijack administrator sessions, alter monitoring configurations, and pivot to the broader network management surface exposed by WhatsUp Gold.

Affected Products

Progress WhatsUp Gold versions released before 2026.0.2
Deployments using the web management console for network monitoring
Environments where multiple authenticated operators share the console

Discovery Timeline

2026-08-12 - CVE-2026-65937 published to NVD
2026-08-13 - Last updated in NVD database
Vendor guidance published in the Progress WhatsUp Gold Security Bulletin

Technical Details for CVE-2026-65937

Vulnerability Analysis

CVE-2026-65937 is a stored XSS issue in the WhatsUp Gold web interface. The application relies on client-side controls to restrict the characters and structure of user-supplied fields. An authenticated attacker can bypass these frontend validations by sending crafted requests directly to the backend API. The server persists the malicious content, which is later rendered to other authenticated users without adequate output encoding.

Because WhatsUp Gold is a network monitoring platform, injected scripts execute in a session with visibility into device inventories, credentials stores, and alerting rules. An attacker who compromises an administrator session gains a launch point into the monitored network.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The vendor security bulletin indicates that validation was enforced at the frontend rather than the server, allowing crafted requests to store unsanitized markup. Rendered output does not consistently encode HTML or JavaScript contexts, allowing persisted payloads to execute.

Attack Vector

Exploitation requires authentication and adjacent network access to the WhatsUp Gold console. The attacker submits a crafted payload that bypasses client-side filters, and the server stores it in a monitored field. A second user, typically an administrator reviewing dashboards or configuration pages, triggers execution simply by loading the page. User interaction is required for the payload to fire, consistent with the stored XSS pattern described in the Progress WhatsUp Gold Security Bulletin.

No verified public exploit code is available. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-65937

Indicators of Compromise

Unexpected <script>, <img onerror=>, or event-handler attributes stored in WhatsUp Gold device names, notes, groups, or alert messages
Outbound requests from operator browsers to unfamiliar domains immediately after loading WhatsUp Gold dashboards
New or modified administrator accounts, credential entries, or notification actions that operators did not create

Detection Strategies

Review WhatsUp Gold audit logs for POST or PUT requests to configuration APIs containing HTML tag characters or JavaScript keywords
Inspect stored configuration objects for encoded payloads such as %3Cscript%3E, javascript:, or base64 blobs in text fields
Compare current WhatsUp Gold configuration exports against a known-good baseline to surface unauthorized field modifications

Monitoring Recommendations

Alert on authenticated user activity that writes markup or script metacharacters into monitoring fields
Monitor operator workstation processes for browser-initiated child processes spawned during WhatsUp Gold sessions
Forward WhatsUp Gold web server access logs to a centralized analytics platform for correlation with account activity

How to Mitigate CVE-2026-65937

Immediate Actions Required

Upgrade all WhatsUp Gold instances to version 2026.0.2 or later as directed in the vendor security bulletin
Restrict network access to the WhatsUp Gold web console to trusted management segments only
Rotate credentials and API tokens for administrators who logged in while an unpatched instance was reachable
Audit stored configuration data for injected markup and remove any suspicious entries

Patch Information

Progress addresses CVE-2026-65937 in WhatsUp Gold 2026.0.2. Consult the Progress WhatsUp Gold Release Notes for upgrade procedures and the Progress WhatsUp Gold Security Bulletin for the full list of fixed issues. Apply the update to every console in redundant or distributed deployments.

Workarounds

Limit WhatsUp Gold console access to a dedicated administrative VLAN behind a jump host
Enforce least privilege on WhatsUp Gold accounts so non-administrative users cannot modify shared fields
Require administrators to use isolated browser profiles for network management tools to reduce cross-application exposure

bash

# Configuration example: restrict console access at the perimeter firewall
# Replace addresses with your management network and console host
iptables -A INPUT -p tcp --dport 9643 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9643 -j DROP