CVE-2026-65939 Progress Software Corporation CVE debrief

Who should care

WhatsUp Gold users, administrators, and security teams should be aware of this vulnerability and take immediate action to protect their systems. This includes applying the patch to WhatsUp Gold version 2026.0.2 or later, reviewing and limiting privileges for users, monitoring for suspicious LogToFile actions, and verifying file extensions and access controls. Additionally, security teams should review their incident response plans and ensure that they are prepared to respond to potential exploitation attempts.

Technical summary

A privileged attacker can create a LogToFile action with an arbitrary file extension within the IIS web root in WhatsUp Gold versions before 2026.0.2. This vulnerability allows an attacker to potentially create arbitrary files within the web root, which could lead to further exploitation. WhatsUp Gold users should be cautious of the potential impact on their systems and take steps to mitigate the vulnerability.

Defensive priority

Organizations using WhatsUp Gold versions before 2026.0.2 should prioritize patching to prevent potential arbitrary file creation within the IIS web root.

Recommended defensive actions

• Apply the patch to WhatsUp Gold version 2026.0.2 or later
• Review and limit privileges for users
• Monitor for suspicious LogToFile actions
• Verify file extensions and access controls
• Review incident response plans
• Verify system logs for suspicious activity
• Check for unusual file extensions within the IIS web root

Evidence notes

The CVE record indicates a privileged attacker can create a LogToFile action with an arbitrary file extension within the IIS web root in WhatsUp Gold versions before 2026.0.2. Evidence is limited; further verification is recommended. Organizations should verify the integrity of their WhatsUp Gold installations, review system logs for suspicious activity, and ensure that only authorized personnel have privileges to create LogToFile actions. Additionally, defenders should check for any unusual file extensions within the IIS web root and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.