Multiple Vulnerabilities in Paessler PRTG Network Monitor

Management summary

The Paessler PRTG Security Monitoring was affected by a reflected cross-site scripting vulnerability that allowed arbitrary JavaScript execution through unsanitized input in error responses. It also exposed domain credentials stored in plaintext to users with standard sensor creation privileges. Both issues could be exploited by authenticated users and may lead to session compromise or credential disclosure.

Vendor description

"We provide industry-leading monitoring solutions for businesses of all sizes, from SMBs to large enterprises. In collaboration with trusted partners, we address the challenges of ever-evolving infrastructures, ensuring that businesses can operate without disruption.

Source: https://www.paessler.com/company/about-us

Business recommendation

The vendor provides a patch which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.

Vulnerability overview/description

1) Cross Site Scripting (CVE-2026-4637)

PRTG Security Monitoring reflects the path when trying to acccess a URL which does not exist. For example, the following URL leads to a 403 forbidden path error message:

https:// <$IP>/not_existing/welcome.htm

HTTP/1.1 403 Forbidden Path: /not_existing/
[Error 403: Forbidden Path: /not_existing/]

The extension ".htm" is required at the end of the URL. HTML code is not sanitized in the URL and will be reflected. Unauthorized attackers can execute arbitrary JavaScript code in the victim's browser in the context of the attacked PRTG installation.

2) Plaintext Storage of Password (CVE-2026-4638)

A PRTG user can select pre-defined scripts when creating an EXE/Script sensor. One pre-defined VBScript takes two integers as arguments and returns their product (e.g. arg1=7 arg2=7, result=49). cscript.exe generally returns an error if calculating strings. The error contains the string itself. A documented variable %windowspassword holds the configured domain user password which can be used as argument for the VBScript and thus gets reflected as error when trying to run the script.

The PRTG user must not be a read-only user and sensor creation needs to be allowed (default).

Proof of concept

1) Cross Site Scripting (CVE-2026-4637)

The following URL can be used as a proof of concept reflecting back the victim's session cookie:

https:// <$IP>/<script>alert(document.cookie)</script>/welcome.htm

Since the HttpOnly flag is not set, the cookie will be reflected if a victim has a session and opens the URL.

HTTP/1.1 403 Forbidden Path: /<script>alert(document.cookie)</script>/
[Error 403: Forbidden Path: /<script>alert(document.cookie)</script>/]

2) Plaintext Storage of Password (CVE-2026-4638)

The following steps can be performed to reflect the configured domain user password:

- Create a new sensor EXE/Script
- Select 'Demo VBScript - Multiplies two integers(2 parameters).vbs'
- Use parameter value: '%windowspassword %windowspassword'
- Save
- Click on the refresh symbol to execute the script
- The cscript error in the red paragraph shows the plaintext password

Output:

Response not well-formed: "(C:\Program Files (x86)\PRTG Network Monitor\
custom sensors\EXE\Demo VBScript - Multiplies two integers(2 parameters).vbs(6, 1)
Microsoft VBScript runtime error: Type mismatch: '[string: "asdfQWER1234!"]' )"
(code: PE132)

Vulnerable / tested versions

The following version has been tested which was the latest version available at the time of the test:

• 25.4.114.1032+

According to the vendor, versions before 26.2.120.1449 are affected.

Vendor contact timeline