DEV Community

kozhevniko
kozhevniko

Posted on

Patching PRTG: What Build 26.2.120.1449 Changes for CVE-2026-4637 and CVE-2026-4638

#vulnerability #prtg #cve20264638

Patching PRTG: What Build 26.2.120.1449 Changes for CVE-2026-4637 and CVE-2026-4638

Paessler's fixed build for PRTG Network Monitor is 26.2.120.1449. It closes a reflected cross-site scripting flaw and an error-message credential disclosure that SEC Consult Vulnerability Lab reported on 24 September 2026. Knowing which installations need the update, and what else to check afterwards, matters more than the score attached to either issue.

Vulnerability overview

CVE-2026-4637 covers the scripting flaw, NVD scoring it 5.1 under CVSS 4.0 and classifying it as CWE-79. CVE-2026-4638 covers the disclosure, NVD scoring it 7.1 under CVSS 4.0 and classifying it as CWE-209. CERT-Bund groups both under WID-SEC-2026-3565 with a CVSS 3.1 base score of 8.1, and SEC Consult rates the combined impact high on the strength of the second issue.

Mechanism and exploitation conditions

The scripting flaw is an output-encoding failure in an error path. A request for a non-existent resource ending in .htm produces an HTTP 403 "Forbidden Path" response that reproduces the requested path in the body. Markup in the path becomes markup in the page, and the page runs in the PRTG origin. An anonymous attacker supplies the link; a logged-in operator supplies the session. The session cookie lacks the HttpOnly attribute, which turns script execution into cookie theft.
The disclosure flaw needs a sensor, not a browser. A demo EXE/Script sensor multiplies two integers through cscript.exe. A non-numeric argument produces a "Type mismatch" error that echoes the argument. Because %windowspassword is a documented placeholder resolving to the password PRTG uses, passing it as the argument places that password in the error text. Any non-read-only PRTG user who may create sensors can do this, which is the default.

Impact

Taken together the two issues reach two different assets. The scripting flaw reaches the operator session and, through it, the monitoring configuration. The disclosure reaches the credential PRTG uses against monitored Windows or domain systems. The second has the longer tail: a leaked collection account may remain valid long after the software is patched, and its reach is defined by the monitoring scope rather than by PRTG itself.

Affected products and scope

Every PRTG Network Monitor installation below 26.2.120.1449 falls in the affected range described by the CNA record and by CERT-Bund, which lists product references for PRTG below 26.2.120.1449 and for 26.2.120.1449. SEC Consult tested 25.4.114.1032. The advisory records a disclosure timeline running from the initial vendor contact on 29 January 2026 to public release on 24 September 2026, with the fix landing in build 26.2.120.1449 on 3 June 2026.

Exposure context

On 25 September 2026 a ZoomEye query for app="PRTG" returned 73,798 assets with sub_type all. The companion query vul.cve="CVE-2026-4638" returned no matches. The first count identifies devices that present a PRTG fingerprint; it does not distinguish patched from unpatched builds, internet-facing from internal deployments, or configured privilege levels. The zero indicates only that ZoomEye had not indexed the CVE identifier.

Remediation and mitigations

Apply build 26.2.120.1449 or later. The download page is https://www.paessler.com/de/download/ and the vendor advisory is https://paessler.freshdesk.com/en/support/solutions/articles/76000088640. SEC Consult's advisory at https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-paessler-prtg-network-monitor/ lists no workaround.
After patching, two follow-ups belong on the checklist. Rotate or review the Windows or domain credential used by PRTG, because the flaw displayed it rather than exposing it through a channel the patch can close. And decide whether the PRTG web interface needs to be reachable from untrusted networks, since the scripting flaw needs nothing more than a browser request and an active operator session.

References

Top comments (0)