Is CVE-2026-65937 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65937 being exploited in the wild.

How severe is CVE-2026-65937?

High severity, with a CVSS score of 8, published 12 August 2026.

Which products and versions are affected?

Progress WhatsUp Gold before 2026.0.2.

Is there a fix for CVE-2026-65937?

A patch was published on 2026-08-12: Fixed in WhatsUp Gold 2026.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65937 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-65937?

Check whether you run Progress WhatsUp Gold at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65937: Progress WhatsUp Gold persistent XSS via frontend bypass

CVE-2026-65937 · Severity: high · CVSS 8 · Published 2026-08-12

WhatsUp Gold is a network monitoring and management platform used by enterprises to monitor infrastructure and application health. An authenticated attacker can bypass frontend security controls and inject malicious scripts that persist in the application, potentially allowing them to steal sensitive data, compromise monitoring integrity, or perform actions on behalf of legitimate users.

Technologies: Progress WhatsUp Gold. Vendors: Progress.

Quick answers

Is CVE-2026-65937 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65937 being exploited in the wild.
How severe is CVE-2026-65937?: High severity, with a CVSS score of 8, published 12 August 2026.
Which products and versions are affected?: Progress WhatsUp Gold before 2026.0.2.
Is there a fix for CVE-2026-65937?: A patch was published on 2026-08-12: Fixed in WhatsUp Gold 2026.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65937 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-65937?: Check whether you run Progress WhatsUp Gold at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a persistent cross-site scripting (XSS) flaw in WhatsUp Gold versions before 2026.0.2. An authenticated attacker can bypass frontend validation controls to inject script content that is stored and executed when other users access the affected application. The vulnerability requires valid authentication credentials to exploit. A successful attack allows the attacker to execute arbitrary JavaScript in the context of other users' browsers, enabling session hijacking, credential theft, or lateral movement within the monitoring environment. Progress has patched this issue in WhatsUp Gold 2026.0.2 released on August 12, 2026.

Affected products

Progress WhatsUp Gold before 2026.0.2

Timeline

2026-08-12: disclosed: CVE-2026-65937 published
2026-08-12: patched: Fixed in WhatsUp Gold 2026.0.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.