CVE-2026-65940: WhatsUp Gold Privilege Escalation Flaw

CVE-2026-65940 Overview

CVE-2026-65940 affects Progress WhatsUp Gold versions released before 2026.0.2. The vulnerability allows a privileged attacker on an adjacent network to write arbitrary files to a web-accessible location on the host server. The flaw is categorized as an incorrect default permissions issue [CWE-276], enabling attackers with existing high privileges to place attacker-controlled content within the web root.

Because files can be dropped into web-accessible paths, an attacker can stage web shells, malicious scripts, or overwrite legitimate application resources. The vulnerability requires no user interaction and impacts confidentiality, integrity, and availability of the affected host.

Critical Impact
A privileged, adjacent-network attacker can write arbitrary files into the WhatsUp Gold web root, enabling web shell placement and follow-on remote code execution against the monitoring server.

Affected Products

Progress WhatsUp Gold versions prior to 2026.0.2
Progress WhatsUp Gold 2026.0.0 and 2026.0.1 releases
Deployments exposing the WhatsUp Gold web console to adjacent network segments

Discovery Timeline

2026-08-12 - CVE-2026-65940 published to the National Vulnerability Database
2026-08-12 - Progress publishes the WhatsUp Gold Security Bulletin - August 2026
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65940

Vulnerability Analysis

WhatsUp Gold is a network monitoring platform from Progress Software. The vulnerability stems from improper permission enforcement on file-write operations exposed by the application. An authenticated user holding elevated application privileges can direct the platform to write files into directories served by the built-in web server.

Because the write location overlaps with the web-accessible content root, uploaded files become reachable through HTTP requests to the monitoring server. This transforms a permissions weakness into a practical foothold for code execution, defacement, or persistence on the monitoring host.

The attack vector is Adjacent Network, meaning the attacker must reach the WhatsUp Gold interface from the same logical network segment. No user interaction is required, and the impact spans confidentiality, integrity, and availability.

Root Cause

The root cause is Incorrect Default Permissions [CWE-276]. Application functionality that writes files does not restrict the destination path to a non-executable, non-web-served directory. As a result, privileged users can specify or reach locations inside the web application's document tree, violating the intended trust boundary between administrative file operations and public web content.

Attack Vector

An attacker first obtains high-privilege credentials on the WhatsUp Gold application, whether through credential theft, insider access, or reuse of exposed administrative accounts. From an adjacent network position, the attacker authenticates to the management interface and invokes the vulnerable file-write functionality.

The attacker supplies file content and a path resolving inside the web root, then requests the newly placed file over HTTP or HTTPS to execute or serve it. Progress has not released public proof-of-concept exploit code, and no exploitation has been reported in the wild. Refer to the Progress WhatsUp Gold Security Bulletin for vendor-supplied technical details.

Detection Methods for CVE-2026-65940

Indicators of Compromise

Unexpected files, particularly .asp, .aspx, .ashx, or script files, appearing under the WhatsUp Gold web content directories
HTTP requests to unfamiliar URIs on the WhatsUp Gold web server returning executable content or shell output
Web server processes spawning cmd.exe, powershell.exe, or other interpreters on the WhatsUp Gold host
Administrative account logins from unusual adjacent-network sources followed by write operations

Detection Strategies

Baseline the contents of the WhatsUp Gold web directories and alert on any new or modified files outside patch windows
Monitor authenticated administrative sessions and correlate them with subsequent file-system changes on the server
Inspect IIS or embedded web server access logs for requests to files that were not part of the shipped application
Enable file integrity monitoring on the WhatsUp Gold installation path and its web-accessible subdirectories

Monitoring Recommendations

Forward WhatsUp Gold application, authentication, and web server logs to a centralized log platform for correlation
Alert on child processes of the WhatsUp Gold web server that are not part of normal operation
Track privileged account activity, including credential changes and role assignments within the WhatsUp Gold console
Segment the monitoring server so that adjacent-network exposure is limited to a small, auditable administrative VLAN

How to Mitigate CVE-2026-65940

Immediate Actions Required

Upgrade WhatsUp Gold to version 2026.0.2 or later as directed in the vendor security bulletin
Rotate credentials for all high-privilege WhatsUp Gold accounts and audit recent administrative activity
Review the web-accessible directories for unauthorized files and remove any that are not part of the vendor distribution
Restrict network access to the WhatsUp Gold management interface to trusted administrative hosts only

Patch Information

Progress addressed CVE-2026-65940 in WhatsUp Gold 2026.0.2. Details are available in the WhatsUp Gold Security Bulletin - August 2026 and the WhatsUp Gold 2026.0 Release Notes. Apply the update during a scheduled maintenance window and validate that all WhatsUp Gold components and plugins are upgraded together.

Workarounds

Limit membership in WhatsUp Gold administrative roles to the minimum number of accounts required for operations
Place the WhatsUp Gold server behind network access controls that restrict adjacent-network reachability to jump hosts
Enforce multi-factor authentication in front of the WhatsUp Gold console using an upstream reverse proxy where feasible
Enable file integrity monitoring on the web content directories to detect unauthorized file writes until patching is complete

bash

# Configuration example
# Restrict inbound access to the WhatsUp Gold web console to a trusted admin subnet (Windows firewall)
New-NetFirewallRule -DisplayName "WUG-Admin-Only" -Direction Inbound -Protocol TCP `
  -LocalPort 443 -RemoteAddress 10.10.10.0/24 -Action Allow
New-NetFirewallRule -DisplayName "WUG-Block-Other" -Direction Inbound -Protocol TCP `
  -LocalPort 443 -Action Block