SB2026081363 - Multiple vulnerabilities in WhatsUp Gold

Description

This security bulletin contains information about 5 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2026-65937)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in the web interface when rendering stored content. A remote user can submit specially crafted content to execute arbitrary script in a victim's browser.

2) Improper Authorization (CVE-ID: CVE-2026-65938)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access scheduled reports without authorization.

The vulnerability exists due to improper authorization in the Scheduled Reports API when handling requests. A remote user can send a crafted request to access scheduled reports without authorization.

3) Improper access control (CVE-ID: CVE-2026-65939)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to write arbitrary files.

The vulnerability exists due to improper access control in the LogToFile action handler when handling file write operations. A remote user can invoke the affected action handler to write arbitrary files.

4) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-65940)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to write arbitrary files to a web-accessible location on the host server.

The vulnerability exists due to improper access control in filesystem permissions when accessing the host server filesystem. A local privileged user can write arbitrary files to write arbitrary files to a web-accessible location on the host server.

5) Input validation error (CVE-ID: CVE-2026-65941)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in an internal report scheduling service when handling requests. A remote attacker can send a specially crafted request to execute arbitrary code.

Remediation

Install update from vendor's website.

References

• https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026?popup=true&overview
• https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026