CVE-2026-65941: WhatsUp Gold RCE Vulnerability

CVE-2026-65941 Overview

CVE-2026-65941 is a high-severity remote code execution vulnerability in Progress WhatsUp Gold versions released before 2026.0.2. An unauthenticated attacker with adjacent network access to the affected service can execute arbitrary code in the context of the Internet Information Services (IIS) application service account. The flaw is categorized under [CWE-73: External Control of File Name or Path], indicating that untrusted input influences file path resolution within the application. Progress documented the issue in the WhatsUp Gold Security Bulletin - August 2026.

Critical Impact
Unauthenticated attackers on an adjacent network can achieve arbitrary code execution as the IIS application service account, compromising the monitoring server and any credentials it stores for managed devices.

Affected Products

Progress WhatsUp Gold versions released before 2026.0.2
Progress WhatsUp Gold IIS-hosted web components
Network monitoring deployments using vulnerable WhatsUp Gold builds

Discovery Timeline

2026-08-12 - CVE-2026-65941 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database
August 2026 - Progress publishes the WhatsUp Gold Security Bulletin addressing the issue

Technical Details for CVE-2026-65941

Vulnerability Analysis

The vulnerability resides in the WhatsUp Gold web application hosted under IIS. Because the weakness is classified as [CWE-73], the application accepts attacker-controlled input that influences a file name or path used by the server. Improper validation of that input allows an attacker to steer file operations to attacker-chosen locations, ultimately leading to arbitrary code execution in the IIS application pool identity. No authentication is required, and no user interaction is needed to trigger the flaw.

Because WhatsUp Gold typically runs with broad network reach and stores credentials for the devices it monitors, code execution on the server exposes downstream infrastructure. Attackers gaining a foothold can pivot to switches, routers, and hypervisors that WhatsUp Gold polls with privileged accounts.

Root Cause

The root cause is external control of a file name or path within the WhatsUp Gold service. User-supplied data reaches a file-handling routine without adequate normalization or allow-list checks. This enables an attacker to redirect the application to write, load, or execute content from a controlled location.

Attack Vector

The attack requires adjacent network access (AV:A) to the WhatsUp Gold service, low complexity, and no privileges or user interaction. An attacker with reachability to the monitoring server sends a crafted request that manipulates the vulnerable file path parameter, triggering execution under the IIS application service account. Refer to the Progress WhatsUp Gold Security Bulletin for vendor-authored exploitation context.

No verified proof-of-concept code is publicly available. See the WhatsUp Gold 2026.0 Release Notes for changes shipped in the fixed release.

Detection Methods for CVE-2026-65941

Indicators of Compromise

Unexpected child processes spawned by the IIS worker process w3wp.exe on the WhatsUp Gold server, such as cmd.exe, powershell.exe, or rundll32.exe.
New or modified files in WhatsUp Gold web directories, particularly .aspx, .ashx, or .dll files with recent timestamps.
Outbound network connections from the WhatsUp Gold host to unknown external addresses following inbound HTTP requests.

Detection Strategies

Review IIS access logs for anomalous requests targeting WhatsUp Gold endpoints, especially requests containing path traversal sequences or unexpected file extensions in parameters.
Alert on process creation events where w3wp.exe is the parent of a scripting or shell interpreter.
Monitor for file writes into the WhatsUp Gold web root originating from the IIS application pool identity.

Monitoring Recommendations

Ingest IIS logs, Windows Security event logs, and Sysmon telemetry from all WhatsUp Gold servers into a centralized analytics platform for correlation.
Baseline expected outbound traffic from monitoring servers and alert on deviations, since WhatsUp Gold servers typically communicate on well-defined ports to managed devices.
Track authentication events for accounts stored in WhatsUp Gold credential libraries to detect misuse following any suspected compromise.

How to Mitigate CVE-2026-65941

Immediate Actions Required

Upgrade WhatsUp Gold to version 2026.0.2 or later as directed by the Progress WhatsUp Gold Security Bulletin.
Restrict network access to the WhatsUp Gold web interface and service ports to trusted management subnets only.
Rotate credentials stored in WhatsUp Gold credential libraries if compromise is suspected, since the IIS service account can access them.
Audit the WhatsUp Gold server for unexpected files, scheduled tasks, or user accounts created since the vulnerable version was deployed.

Patch Information

Progress addressed CVE-2026-65941 in WhatsUp Gold 2026.0.2. Administrators should download the fixed release from the Progress customer portal and follow the upgrade procedure in the WhatsUp Gold 2026.0 Release Notes. Verify the installed version after upgrade to confirm remediation.

Workarounds

Place the WhatsUp Gold server behind a firewall or VPN that limits access to authorized administrators only.
Apply network segmentation to isolate the monitoring server from general user networks and the internet.
Run the IIS application pool with the least-privileged service account possible to reduce blast radius if exploitation occurs.

bash

# Example: restrict inbound access to WhatsUp Gold web ports using Windows Firewall
New-NetFirewallRule -DisplayName "WhatsUp Gold - Admin Subnet Only" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 9643,9644 \
  -RemoteAddress 10.10.20.0/24 \
  -Action Allow

New-NetFirewallRule -DisplayName "WhatsUp Gold - Block All Other" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 9643,9644 \
  -Action Block