# CVE-2026-65940: Progress WhatsUp Gold arbitrary file write to web-accessible location

Source: https://junglewise.ai/threats/cve-2026-65940-progress-whatsup-gold-arbitrary-file-write-to-web-accessible  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65940 · Severity: medium · CVSS 6.8 · Published 2026-08-12

WhatsUp Gold is a network monitoring and management platform used by organizations to track infrastructure health and availability. A privileged attacker with administrative access can exploit a flaw to write arbitrary files to directories accessible via the web server, potentially enabling remote code execution, configuration tampering, or exposure of sensitive data to unauthorized users.

Technologies: [Progress WhatsUp Gold](https://junglewise.ai/threats/technologies/whatsup-gold). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-65940 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65940 being exploited in the wild.

**How severe is CVE-2026-65940?** Medium severity, with a CVSS score of 6.8, published 12 August 2026.

**Which products and versions are affected?** Progress WhatsUp Gold before 2026.0.2.

**Is there a fix for CVE-2026-65940?** A patch was published on 2026-08-12: Fix released in WhatsUp Gold 2026.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65940 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-65940?** Check whether you run Progress WhatsUp Gold at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability allows a privileged attacker to write arbitrary files to a web-accessible location on the WhatsUp Gold server. The attack requires existing administrative or elevated privileges on the system. By writing malicious files to web-accessible directories, an attacker can achieve code execution via HTTP requests, modify application behavior, or exfiltrate sensitive information. The vulnerability is present in versions prior to 2026.0.2, which was released on August 12, 2026. A patch is available in version 2026.0.2 and later.

## Affected products

- Progress WhatsUp Gold before 2026.0.2

## Timeline

- 2026-08-12: disclosed: CVE-2026-65940 published
- 2026-08-12: patched: Fix released in WhatsUp Gold 2026.0.2

## References

- [https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026](https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2026)
- [https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html](https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html)

## Related threats

- [Progress WhatsUp Gold remote code execution](https://junglewise.ai/threats/cve-2026-65941-progress-whatsup-gold-remote-code-execution)
- [Progress WhatsUp Gold arbitrary file extension in LogToFile](https://junglewise.ai/threats/cve-2026-65939-progress-whatsup-gold-arbitrary-file-extension-in-logtofile)
- [Progress WhatsUp Gold improper authorization in Scheduled Reports API](https://junglewise.ai/threats/cve-2026-65938-progress-whatsup-gold-improper-authorization-in-scheduled-reports)
- [Progress WhatsUp Gold persistent XSS via frontend bypass](https://junglewise.ai/threats/cve-2026-65937-progress-whatsup-gold-persistent-xss-via-frontend-bypass)
- [Progress WhatsUp Gold Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-4885-progress-whatsup-gold-path-traversal-vulnerability)