CVE-2026-65938 Progress Software Corporation CVE debrief

Who should care

Organizations using WhatsUp Gold versions before 2026.0.2 should be aware of this vulnerability and take steps to patch or mitigate it. This includes reviewing and updating their current security controls, monitoring for suspicious activity, and ensuring that only authorized users have access to the Scheduled Reports API. Additionally, security teams should prioritize patching this vulnerability to prevent potential exploitation by authenticated users with malicious intent. The vulnerability's MEDIUM severity and CVSS score of 4.3 indicate a moderate level of risk that should be addressed promptly but not at the expense of higher-priority vulnerabilities. Affected operators and platforms should review compensating controls and ensure that their vulnerability management processes are up-to-date. Security teams should also verify that their incident response plans account for potential exploitation of this vulnerability and that detection and monitoring capabilities are in place to identify suspicious activity related to the Scheduled Reports API. To further mitigate the risk, organizations can implement additional security measures such as limiting access to the Scheduled Reports API, monitoring for unusual activity, and reviewing system logs for potential security incidents. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their systems from potential exploitation. It's also essential to track exceptions, retest remediated assets, and close the item only after evidence is documented to ensure that the vulnerability is fully remediated and that there are no residual risks. Finally, organizations should consider implementing a robust vulnerability management program to identify and address potential vulnerabilities before they can be exploited by attackers. This program should include regular vulnerability assessments, patch management, and employee training on security best practices to prevent similar vulnerabilities from being exploited in the future. By prioritizing patching and implementing additional security measures, organizations can minimize the risk associated with this vulnerability and protect их_

Technical summary

The CVE-2026-65938 vulnerability affects WhatsUp Gold versions released before 2026.0.2. An improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions. The CVSS score is 4.3, and the severity is MEDIUM. This vulnerability can be patched by updating WhatsUp Gold to version 2026.0.2 or later. In the meantime, access to the Scheduled Reports API should be restricted, and suspicious activity should be monitored.

Defensive priority

Organizations using WhatsUp Gold versions before 2026.0.2 should prioritize patching the improper authorization vulnerability in the Scheduled Reports API.

Recommended defensive actions

• Patch WhatsUp Gold to version 2026.0.2 or later
• Restrict access to the Scheduled Reports API
• Monitor for suspicious activity on the Scheduled Reports API
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates an improper authorization vulnerability in WhatsUp Gold versions released before 2026.0.2. The Scheduled Reports API allows any authenticated user to invoke restricted actions. The CVSS score is 4.3, and the severity is MEDIUM.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.