CVE-2026-65941: WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WhatsUp Goldto a version that resolves this vulnerability.Fixed in 26.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65941?
CVE-2026-65941 has a severity rating of 8.8, which is classified as high.
How do I fix CVE-2026-65941?
To fix CVE-2026-65941, upgrade to WhatsUp Gold version 26.0.2 or later.
What type of vulnerability is CVE-2026-65941?
CVE-2026-65941 is an unauthenticated remote code execution vulnerability.
What software is affected by CVE-2026-65941?
CVE-2026-65941 affects all versions of Ipswitch WhatsUp Gold prior to 26.0.2.
What can an attacker gain by exploiting CVE-2026-65941?
An attacker exploiting CVE-2026-65941 can execute arbitrary code with the privileges of the IIS application service account.