CVE-2026-65941 in WhatsUp Gold
Summary
by MITRE • 08/12/2026
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists within WhatsUp Gold software versions prior to 2026.0.2, representing a critical remote code execution flaw that allows unauthenticated attackers to gain system-level privileges through network access to the affected service. The vulnerability stems from insufficient authentication mechanisms and potentially improper input validation within the IIS application service components, creating an attack surface where malicious actors can exploit the system without requiring valid credentials or prior access. This type of vulnerability typically falls under CWE-287 which addresses authentication failures in software applications, specifically targeting scenarios where authentication checks are bypassed or improperly implemented.
The technical exploitation occurs when an attacker sends specially crafted network requests to the vulnerable WhatsUp Gold service running on IIS, leveraging weaknesses in the application's security model to execute arbitrary code within the context of the IIS application service account. This privilege escalation allows the attacker to perform actions that are normally restricted to authorized users, potentially leading to complete system compromise and unauthorized access to sensitive network resources. The attack vector demonstrates characteristics aligned with ATT&CK technique T1203 which involves exploitation of remote services through unauthenticated access points.
The operational impact of this vulnerability is severe as it enables attackers to establish persistent access to network infrastructure managed by WhatsUp Gold, potentially allowing them to monitor network traffic, escalate privileges further within the network, or deploy additional malicious payloads. Organizations using affected versions face significant risk of data breaches and unauthorized network access, particularly in environments where network monitoring and management systems are centrally located and accessible from external networks. The vulnerability affects the integrity and confidentiality of network monitoring data while potentially compromising the availability of critical network infrastructure services.
Mitigation strategies should include immediate patching to version 2026.0.2 or later, which addresses the authentication bypass issue through proper input validation and authentication enforcement mechanisms. Network segmentation should be implemented to restrict access to the WhatsUp Gold service to trusted administrative networks only, while additional security controls such as firewall rules and intrusion detection systems can help monitor for suspicious network activity related to exploitation attempts. Security teams should also implement regular vulnerability assessments and ensure that all network monitoring tools receive timely updates to prevent similar vulnerabilities from emerging in other components of their infrastructure.