This vulnerability (CVE-2026-65939) affects WhatsUp Gold versions before 2026.0.2. It involves CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-73 (External Control of File Name or Path), and CWE-22 (Path Traversal). A privileged attacker can exploit this by creating a LogToFile action that specifies an arbitrary file extension within the IIS web root directory, potentially allowing dangerous files to be uploaded and executed. The CVSS v3.1 score is 6.8 with attack vector as adjacent network, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

The vulnerability allows a privileged attacker to upload files with arbitrary extensions into the IIS web root, which could lead to execution of malicious files, compromising confidentiality, integrity, and availability of the affected system. The CVSS score of 6.8 reflects a medium severity impact with high potential damage if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileged access to the WhatsUp Gold application and IIS web root directories to trusted administrators only. Monitor for suspicious file creation activities within the IIS web root. Avoid exposing the management interface to untrusted networks.