CVE-2026-65939 in WhatsUp Gold
Summary
by MITRE • 08/12/2026
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in WhatsUp Gold versions prior to 2026.0.2 where a privileged attacker with sufficient access rights can manipulate the LogToFile action functionality to specify arbitrary file extensions within the Internet Information Services web root directory. The flaw stems from inadequate input validation and sanitization of file path parameters, allowing malicious actors to potentially execute arbitrary code or manipulate log files in ways that could compromise system integrity and confidentiality.
The technical implementation of this vulnerability involves the manipulation of logging actions within the WhatsUp Gold application interface where attackers can specify file extensions that may bypass normal security restrictions imposed by the web server. This weakness creates a potential attack vector where an attacker with administrative privileges or equivalent access can leverage this functionality to place malicious files in the IIS web root, potentially leading to remote code execution or privilege escalation scenarios.
From an operational perspective, this vulnerability presents significant risks to organizations relying on WhatsUp Gold for network monitoring and management. The impact extends beyond simple file manipulation as it could enable attackers to establish persistent access points within the network infrastructure, particularly when combined with other exploitation techniques. Security professionals must consider the potential for this vulnerability to be used in conjunction with web server misconfigurations or other application flaws to create more sophisticated attack chains.
The vulnerability aligns with CWE-22 which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal attacks, and may also relate to CWE-73 which covers external control of file name or path. From an ATT&CK framework perspective, this weakness maps to techniques involving privilege escalation and persistence mechanisms through web server manipulation. Organizations should implement immediate mitigations including applying the 2026.0.2 patch, restricting administrative access to the WhatsUp Gold application, implementing proper input validation for file operations, and conducting thorough security assessments of all IIS configurations to prevent unauthorized file placement in web root directories.
Security monitoring should specifically focus on unusual file creation patterns within web server directories, particularly those involving log files or configuration elements. Network segmentation and least privilege principles should be enforced to limit the potential impact of successful exploitation attempts. Regular vulnerability scanning and application security assessments should include verification of proper file path handling within all web applications to prevent similar issues from occurring in other systems.