CVE-2026-65938: WhatsUp Gold Auth Bypass Vulnerability

CVE-2026-65938 Overview

CVE-2026-65938 is an improper authorization vulnerability in the Scheduled Reports API of Progress WhatsUp Gold versions released before 2026.0.2. The flaw allows any authenticated user to invoke restricted actions that should be limited to privileged roles. The weakness maps to [CWE-602: Client-Side Enforcement of Server-Side Security]. Exploitation requires adjacent-network access and valid credentials, and impacts data integrity within the Scheduled Reports subsystem. Progress addressed the issue in the WhatsUp Gold 2026.0.2 release.

Critical Impact
Authenticated users on adjacent networks can bypass role restrictions in the Scheduled Reports API, allowing unauthorized changes to scheduled reporting actions in WhatsUp Gold deployments.

Affected Products

Progress WhatsUp Gold versions released before 2026.0.2
Progress WhatsUp Gold Scheduled Reports API component
Network monitoring deployments running vulnerable WhatsUp Gold builds

Discovery Timeline

2026-08-12 - CVE-2026-65938 published to NVD
2026-08-12 - Last updated in NVD database
August 2026 - Progress releases WhatsUp Gold Security Bulletin with fix in 2026.0.2

Technical Details for CVE-2026-65938

Vulnerability Analysis

The Scheduled Reports API in WhatsUp Gold enforces authorization checks incorrectly, allowing any authenticated account to invoke actions that should be restricted to administrative roles. The server trusts client-supplied context or fails to re-validate the caller's role at the API endpoint. As a result, low-privileged users can trigger administrative Scheduled Reports operations. The consequence is limited integrity impact against report scheduling data, without confidentiality or availability effects.

Root Cause

The root cause is [CWE-602] Client-Side Enforcement of Server-Side Security. Authorization logic that should be enforced server-side on Scheduled Reports API endpoints is either missing or bypassable. The server accepts requests from any authenticated session regardless of assigned role or permission scope.

Attack Vector

An attacker needs valid credentials and network reachability to the WhatsUp Gold management interface on an adjacent network segment. The attacker authenticates as any user, then issues crafted HTTP requests to the Scheduled Reports API endpoints. Because the API does not enforce role-based restrictions, the requests succeed and modify scheduled report configuration. No user interaction or elevated privileges are required beyond initial authentication.

No verified public proof-of-concept code has been published. Refer to the Progress WhatsUp Gold Security Bulletin for vendor technical details.

Detection Methods for CVE-2026-65938

Indicators of Compromise

Unexpected changes to Scheduled Reports configuration performed by non-administrative accounts
Scheduled Reports API requests originating from user sessions that lack the corresponding role
New or modified scheduled report jobs created outside of change-management windows

Detection Strategies

Audit WhatsUp Gold application logs for Scheduled Reports API calls, correlating the invoking user's role with the requested action
Alert on any Scheduled Reports create, update, or delete operation performed by an account that is not in the administrator or report-manager group
Baseline normal Scheduled Reports API usage and flag deviations in caller identity or request volume

Monitoring Recommendations

Forward WhatsUp Gold web and API access logs to a centralized SIEM for role-versus-action correlation
Monitor authentication events for the WhatsUp Gold console and identify accounts that authenticate from unusual adjacent network segments
Track configuration drift on scheduled reporting jobs and generate alerts on unexpected modifications

How to Mitigate CVE-2026-65938

Immediate Actions Required

Upgrade WhatsUp Gold to version 2026.0.2 or later as documented in the WhatsUp Gold 2026.0 Release Notes
Review all WhatsUp Gold user accounts and disable inactive or unnecessary credentials
Audit existing scheduled reports for unauthorized additions or modifications before patching

Patch Information

Progress addressed CVE-2026-65938 in WhatsUp Gold 2026.0.2. Administrators should apply the update following the guidance in the Progress WhatsUp Gold Security Bulletin. After upgrading, verify the running build reports 2026.0.2 or newer in the management console.

Workarounds

Restrict network access to the WhatsUp Gold management interface to trusted administrative subnets via firewall or VLAN segmentation
Enforce strong authentication and rotate credentials for all WhatsUp Gold accounts, particularly non-administrative users
Limit the number of accounts with any level of WhatsUp Gold access until the patch is deployed

bash

# Example: restrict WhatsUp Gold management access to an admin subnet (Windows firewall)
New-NetFirewallRule -DisplayName "WhatsUpGold-Admin-Only" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 9643 \
  -RemoteAddress 10.10.20.0/24 \
  -Action Allow

New-NetFirewallRule -DisplayName "WhatsUpGold-Block-Other" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 9643 \
  -Action Block