CVE-2026-65937: WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI

Published Aug 12, 2026
·
Updated

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

Affected Software

1 affected component
Progress WhatsUp Gold<26.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade WhatsUp Gold to a version that resolves this vulnerability.

    Fixed in 26.0.2

Event History

Aug 12, 2026
CVE Published
via MITRE·03:21 PM
Data Sourced
via MITRE·03:21 PM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-65937?

CVE-2026-65937 has a severity rating of high, with a score of 8.

2

How do I fix CVE-2026-65937?

To remediate CVE-2026-65937, upgrade to WhatsUp Gold version 26.0.2 or later.

3

What type of vulnerability is CVE-2026-65937?

CVE-2026-65937 is classified as a stored cross-site scripting (XSS) vulnerability.

4

Who is affected by CVE-2026-65937?

CVE-2026-65937 affects users of Progress WhatsUp Gold versions prior to 26.0.2.

5

Can CVE-2026-65937 be exploited remotely?

Yes, CVE-2026-65937 can be exploited by an authenticated attacker through the web UI.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2026-65937 - WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI - SecAlerts