CVE-2026-65939CWE-22CWE-434CWE-73path-traversalunrestricted-file-upload

CVE-2026-65939

Medium · published August 12, 2026

CVSS v3.1

6.8

EPSS

Percentile

30.7

In the wild

Unconfirmed

What it is

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

The record

Technical detail

CVSS v3.1: 6.8 · MEDIUM
Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00379 · 30.7th percentile
Weaknesses: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-73 · External Control of File Name or Path
Published: 2026-08-12T20:17Z

Affected products (1)

Product	Versions	Fixed in
progress/whatsup_gold	< 26.0.2	26.0.2

References (3)

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026 · [email protected]https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html · [email protected]https://www.progress.com/network-monitoring · [email protected]

EPSS history

Timeline

12 AUG 15:23Z
WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.
cvelistv5