CVE-2026-65940CWE-276CWE-732

CVE-2026-65940

Medium · published August 12, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Weaknesses
CWE-276 · Incorrect Default Permissions; CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-08-12T20:17Z
Affected products (1)
ProductVersionsFixed in
progress/whatsup_gold< 26.0.226.0.2
References (3)
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026 · [email protected]https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html · [email protected]https://www.progress.com/network-monitoring · [email protected]
EPSS history
Timeline
  • 12 AUG 15:23Z
    WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
    cvelistv5