GCVE-1988-2026-0473

Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
Title
SEC Consult SA-20260924-0 :: Multiple Vulnerabilities in Paessler PRTG Network Monitor #CVE-2026-4637 #CVE-2026-4638
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260924-0 > ======================================================================= title: Multiple Vulnerabilities product: Paessler PRTG Network Monitor vulnerable version: <26.2.120.1449       fixed version: 26.2.120.1449          CVE number: CVE-2026-4637, CVE-2026-4638              impact: high homepage:https://www.paessler.com/prtg/prtg-network-monitor               found: 2026-01-29 by: J. Kruchem (Office Vienna) S. Michlits (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "We provide industry-leading monitoring solutions for businesses of all sizes, from SMBs to large enterprises. In collaboration with trusted partners, we address the challenges of ever-evolving infrastructures, ensuring that businesses can operate without disruption. Source:https://www.paessler.com/company/about-us Business recommendation: ------------------------ The vendor provides a patch which should be installed immediately. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Cross Site Scripting (CVE-2026-4637) PRTG Security Monitoring reflects the path when trying to acccess a URL which does not exist. For example, the following URL leads to a 403 forbidden path error message: https://<$IP>/not_existing/welcome.htm ``` HTTP/1.1 403 Forbidden Path: /not_existing/ [Error 403: Forbidden Path: /not_existing/] ``` The extension ".htm" is required at the end of the URL. HTML code is not sanitized in the URL and will be reflected. Unauthorized attackers can execute arbitrary JavaScript code in the victim's browser in the context of the attacked PRTG installation. 2) Plaintext Storage of Password (CVE-2026-4638) A PRTG user can select pre-defined scripts when creating an EXE/Script sensor. One pre-defined VBScript takes two integers as arguments and returns their product (e.g. arg1=7 arg2=7, result=49). cscript.exe generally returns an error if calculating strings. The error contains the string itself. A documented variable %windowspassword holds the configured domain user password which can be used as argument for the VBScript and thus gets reflected as error when trying to run the script. The PRTG user must not be a read-only user and sensor creation needs to be allowed (default). Proof of concept: ----------------- 1) Cross Site Scripting (CVE-2026-4637) The following URL can be used as a proof of concept reflecting back the victim's session cookie: https://<$IP>/<script>alert(document.cookie)</script>/welcome.htm Since the HttpOnly flag is not set, the cookie will be reflected if a victim has a session and opens the URL. ``` HTTP/1.1 403 Forbidden Path: /<script>alert(document.cookie)</script>/ [Error 403: Forbidden Path: /<script>alert(document.cookie)</script>/] ``` 2) Plaintext Storage of Password (CVE-2026-4638) The following steps can be performed to reflect the configured domain user password: - Create a new sensor EXE/Script - Select 'Demo VBScript - Multiplies two integers(2 parameters).vbs' - Use parameter value: '%windowspassword %windowspassword' - Save - Click on the refresh symbol to execute the script - The cscript error in the red paragraph shows the plaintext password Output: ``` Response not well-formed: "(C:\Program Files (x86)\PRTG Network Monitor\ custom sensors\EXE\Demo VBScript - Multiplies two integers(2 parameters).vbs(6, 1) Microsoft VBScript runtime error: Type mismatch: '[string: "asdfQWER1234!"]' )" (code: PE132) ``` Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version available at the time of the test: * 25.4.114.1032+ According to the vendor, versions before 26.2.120.1449 are affected. Vendor contact timeline: ------------------------ 2026-01-29: Contacting vendor throughsecurity () paessler com 2026-01-29: Automatic reply that message was received; no further response. 2026-02-09: Following up again, asking for PGP keys. 2026-02-09: Vendor sends PGP key fingerprint, but public PGP key is missing. 2026-02-10: Vendor sends link to PGP key on their website. Sending encrypted advisory to vendor. 2026-02-11: Vendor confirms receipt of advisory and starts internal review. 2026-03-05: Asking for a status update. 2026-03-06: Vendor responded with update for coming week. 2026-03-10: Another vendor contact responds to our initial email from 29th January. 2026-03-11: Clarifying that it is the same report and vendor investigation is already ongoing. 2026-03-23: Vendor stated that the fix will be released in May 27. 2026-03-23: Reserved CVE numbers and communicated them to the vendor. 2026-05-29: Vendor needs to postpone release to 9th July instead of 18th June. 2026-06-03: Vendor fixes issues in version 26.2.120.1449. 2026-06-08: Confirming new release date. 2026-07-02: Vendor drafts communication for customers for the release on 9th July. 2026-07-15: Vendor provides their own security advisory. 2026-07-21: Informing vendor regarding publication delay on our side. 2026-08-12: We will inform vendor regarding release date. 2026-09-23: Planned release for 24th September. 2026-09-24: Public release of security advisory. Solution: --------- The vendor provides a patched version 26.2.120.1449 which can be downloaded from the following URL: https://www.paessler.com/de/download/ Vendor security advisory: https://paessler.freshdesk.com/en/support/solutions/articles/76000088640 Workaround: ----------- None Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your applicationhttps://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local officeshttps://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web:https://www.sec-consult.com Blog:http://blog.sec-consult.com X:https://x.com/sec_consult EOF J. Kruchem, S. Michlits / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Paessler Prtg Network Monitor Affected: unknown
guessed Create a notification for this product.
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0473 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Prtg Network Monitor",
          "vendor": "Paessler",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260924-0 \u003e\n=======================================================================\n              title: Multiple Vulnerabilities\n            product: Paessler PRTG Network Monitor\n vulnerable version: \u003c26.2.120.1449\n\u00a0 \u00a0 \u00a0 fixed version: 26.2.120.1449\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-4637, CVE-2026-4638\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.paessler.com/prtg/prtg-network-monitor\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-29\n                 by: J. Kruchem (Office Vienna)\n                     S. Michlits (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We provide industry-leading monitoring solutions for businesses of all\nsizes, from SMBs to large enterprises. In collaboration with trusted\npartners, we address the challenges of ever-evolving infrastructures,\nensuring that businesses can operate without disruption.\n\nSource:https://www.paessler.com/company/about-us\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Cross Site Scripting (CVE-2026-4637)\nPRTG Security Monitoring reflects the path when trying to acccess a URL which\ndoes not exist. For example, the following URL leads to a 403 forbidden path\nerror message:\n\nhttps://\u003c$IP\u003e/not_existing/welcome.htm\n\n```\nHTTP/1.1 403 Forbidden Path: /not_existing/\n\n[Error 403: Forbidden Path: /not_existing/]\n```\n\nThe extension \".htm\" is required at the end of the URL. HTML code is not\nsanitized in the URL and will be reflected. Unauthorized attackers can\nexecute arbitrary JavaScript code in the victim\u0027s browser in the context\nof the attacked PRTG installation.\n\n\n2) Plaintext Storage of Password (CVE-2026-4638)\nA PRTG user can select pre-defined scripts when creating an EXE/Script sensor.\nOne pre-defined VBScript takes two integers as arguments and returns their\nproduct (e.g. arg1=7 arg2=7, result=49). cscript.exe generally returns\nan error if calculating strings. The error contains the string itself.\nA documented variable %windowspassword holds the configured domain user\npassword which can be used as argument for the VBScript and thus gets\nreflected as error when trying to run the script.\n\nThe PRTG user must not be a read-only user and sensor creation needs to be\nallowed (default).\n\n\nProof of concept:\n-----------------\n1) Cross Site Scripting (CVE-2026-4637)\nThe following URL can be used as a proof of concept reflecting back the\nvictim\u0027s session cookie:\n\nhttps://\u003c$IP\u003e/\u003cscript\u003ealert(document.cookie)\u003c/script\u003e/welcome.htm\n\nSince the HttpOnly flag is not set, the cookie will be reflected if a\nvictim has a session and opens the URL.\n\n```\nHTTP/1.1 403 Forbidden Path: /\u003cscript\u003ealert(document.cookie)\u003c/script\u003e/\n\n[Error 403: Forbidden Path: /\u003cscript\u003ealert(document.cookie)\u003c/script\u003e/]\n```\n\n2) Plaintext Storage of Password (CVE-2026-4638)\nThe following steps can be performed to reflect the configured domain user\npassword:\n\n- Create a new sensor EXE/Script\n- Select \u0027Demo VBScript - Multiplies two integers(2 parameters).vbs\u0027\n- Use parameter value: \u0027%windowspassword %windowspassword\u0027\n- Save\n- Click on the refresh symbol to execute the script\n- The cscript error in the red paragraph shows the plaintext password\n\nOutput:\n```\nResponse not well-formed: \"(C:\\Program Files (x86)\\PRTG Network Monitor\\\ncustom sensors\\EXE\\Demo VBScript - Multiplies two integers(2 parameters).vbs(6, 1)\nMicrosoft VBScript runtime error: Type mismatch: \u0027[string: \"asdfQWER1234!\"]\u0027 )\"\n(code: PE132)\n```\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 25.4.114.1032+\n\nAccording to the vendor, versions before 26.2.120.1449 are affected.\n\n\nVendor contact timeline:\n------------------------\n2026-01-29: Contacting vendor throughsecurity () paessler com\n2026-01-29: Automatic reply that message was received; no further response.\n2026-02-09: Following up again, asking for PGP keys.\n2026-02-09: Vendor sends PGP key fingerprint, but public PGP key is missing.\n2026-02-10: Vendor sends link to PGP key on their website.\n            Sending encrypted advisory to vendor.\n2026-02-11: Vendor confirms receipt of advisory and starts internal review.\n2026-03-05: Asking for a status update.\n2026-03-06: Vendor responded with update for coming week.\n2026-03-10: Another vendor contact responds to our initial email from 29th\n            January.\n2026-03-11: Clarifying that it is the same report and vendor investigation\n            is already ongoing.\n2026-03-23: Vendor stated that the fix will be released in May 27.\n2026-03-23: Reserved CVE numbers and communicated them to the vendor.\n2026-05-29: Vendor needs to postpone release to 9th July instead of 18th June.\n2026-06-03: Vendor fixes issues in version 26.2.120.1449.\n2026-06-08: Confirming new release date.\n2026-07-02: Vendor drafts communication for customers for the release on 9th July.\n2026-07-15: Vendor provides their own security advisory.\n2026-07-21: Informing vendor regarding publication delay on our side.\n2026-08-12: We will inform vendor regarding release date.\n2026-09-23: Planned release for 24th September.\n2026-09-24: Public release of security advisory.\n\n\nSolution:\n---------\nThe vendor provides a patched version 26.2.120.1449 which can be downloaded\nfrom the following URL:\n\nhttps://www.paessler.com/de/download/\n\nVendor security advisory:\nhttps://paessler.freshdesk.com/en/support/solutions/articles/76000088640\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF J. Kruchem, S. Michlits / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/0"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://paessler.freshdesk.com/en/support/solutions/articles/76000088640"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.paessler.com/company/about-us"
        },
        {
          "url": "https://www.paessler.com/de/download/"
        },
        {
          "url": "https://www.paessler.com/prtg/prtg-network-monitor"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260924-0 :: Multiple Vulnerabilities in Paessler PRTG Network Monitor #CVE-2026-4637 #CVE-2026-4638",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-4637",
              "type": "related"
            },
            {
              "destId": "CVE-2026-4638",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0473",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/0",
            "automated": true,
            "contentSha256": "39b165de7607fca0099f04a70a780f6d540579e9073669caa1c491d3c670d4fb",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-01T10:57:56Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0473"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:01Z",
    "dateUpdated": "2026-11-02T07:30:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0473"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.