CVE-2026-65939 Overview
CVE-2026-65939 affects Progress WhatsUp Gold versions released before 2026.0.2. A privileged attacker can abuse the LogToFile action to write files with arbitrary extensions inside the Internet Information Services (IIS) web root. The flaw is classified as a path traversal issue [CWE-22] and stems from insufficient validation of user-controlled file paths in the action handler. Because the write occurs within the web-facing directory tree, an attacker can stage server-side executable content or overwrite existing web resources. Exploitation requires high privileges and adjacent network access to the WhatsUp Gold management interface.
Critical Impact
A privileged attacker on an adjacent network can drop files with arbitrary extensions inside the IIS web root, enabling potential web shell placement and follow-on remote code execution.
Affected Products
- Progress WhatsUp Gold versions released before 2026.0.2
- WhatsUp Gold deployments hosting the IIS-based web console
- WhatsUp Gold LogToFile action component
Discovery Timeline
- 2026-08-12 - CVE-2026-65939 published to the National Vulnerability Database (NVD)
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-65939
Vulnerability Analysis
WhatsUp Gold exposes an action framework that lets operators trigger tasks when monitoring conditions are met. The LogToFile action writes log entries to a caller-specified destination. In versions prior to 2026.0.2, the action does not restrict the file extension or verify that the resulting path stays outside sensitive directories. An authenticated attacker with configuration privileges can craft a LogToFile action that writes to a path inside the IIS web root, such as the WhatsUp Gold web console directory. Choosing an extension handled by the ASP.NET pipeline turns the log file into server-side executable content served by IIS. The write happens under the WhatsUp Gold service account, which typically has permissions across the web root.
Root Cause
The root cause is missing path and extension validation in the LogToFile action handler [CWE-22]. The component treats the destination path as trusted input and does not enforce an allowlist of extensions, a fixed log directory, or canonicalization checks against the IIS web root.
Attack Vector
Exploitation requires an authenticated account with permission to create or modify actions in the WhatsUp Gold console. The attacker configures a LogToFile action pointing at a path under the IIS-hosted application, then triggers the action through a monitored condition. Once the file lands in a directory served by IIS, the attacker requests it over HTTP to invoke server-side execution or serve arbitrary content. See the Progress Security Bulletin August 2026 for vendor technical details.
// No verified public proof-of-concept is available.
// Refer to the Progress Security Bulletin for technical details.
Detection Methods for CVE-2026-65939
Indicators of Compromise
- New or modified LogToFile action configurations that reference paths outside the standard WhatsUp Gold log directory.
- Files with web-executable extensions (.aspx, .ashx, .asp, .config) appearing under the WhatsUp Gold IIS web root.
- IIS access log entries requesting newly created files in the WhatsUp Gold web application directory.
- Outbound network connections from the WhatsUp Gold service account following suspicious file writes.
Detection Strategies
- Audit the WhatsUp Gold action configuration store for LogToFile entries whose target paths resolve inside the IIS wwwroot or WhatsUp Gold web application folder.
- Correlate file-creation events under the IIS web root with the WhatsUp Gold service process identity to surface unexpected writes.
- Alert on IIS requests to file names that were created in the last 24 hours and match uncommon action-generated patterns.
Monitoring Recommendations
- Enable file integrity monitoring on the WhatsUp Gold IIS web root and alert on any file creation with executable extensions.
- Forward WhatsUp Gold application logs and IIS logs to a centralized SIEM for correlation and retention.
- Track privileged administrative logins to the WhatsUp Gold console and review action changes performed by those accounts.
How to Mitigate CVE-2026-65939
Immediate Actions Required
- Upgrade WhatsUp Gold to version 2026.0.2 or later as specified in the vendor advisory.
- Review all existing LogToFile actions and remove any that write outside the designated log directory.
- Restrict administrative and action-configuration privileges to a minimal set of trusted accounts.
- Place the WhatsUp Gold management interface behind network segmentation so only authorized operators can reach it.
Patch Information
Progress addresses CVE-2026-65939 in WhatsUp Gold 2026.0.2. Refer to the Progress WhatsUp Gold Release Notes and the Progress Security Bulletin August 2026 for the fixed version and upgrade guidance.
Workarounds
- Remove or disable the ability to create new LogToFile actions for non-administrative users until the patch is deployed.
- Configure IIS request filtering to block execution of unexpected file types within the WhatsUp Gold web application directory.
- Isolate the WhatsUp Gold server on a dedicated management VLAN and enforce firewall rules limiting console access.
# Example: IIS request filtering to deny execution of unexpected file types
# Run on the WhatsUp Gold IIS host, adjust site name as needed
%windir%\system32\inetsrv\appcmd set config "WhatsUpGold" \
-section:system.webServer/security/requestFiltering \
/+"fileExtensions.[fileExtension='.aspx',allowed='false']" /commit:apphost
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
