CVE Catalog
CVE-2026-65939
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk0.24%
15th percentile - higher than 15% of all known CVEs
Summary
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
Risk Assessment
Creating files with arbitrary extensions in the IIS root may allow script execution or bypass server security.
Recommendation
It is recommended to upgrade to version 2026.0.2 or later and restrict the ability to create LogToFile actions for unauthorized users.
Original NVD description (English source)
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.