CVE-2026-4638
Received Received - Intake

Information Disclosure in PRTG Network Monitor

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: SEC Consult Vulnerability Lab

Description
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.  Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-4638
EUVD
EUVD-2026-85847

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
paessler prtg_network_monitor to 26.2.120.1449 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in PRTG Network Monitor versions before 26.2.120.1449. It involves a demo sensor that incorrectly handles non-numeric input, causing a runtime error that exposes the Windows/domain password in plaintext. Attackers with sensor creation permissions can exploit this by passing a placeholder variable (%windowspassword) to retrieve the password from error messages.

Detection Guidance

Check PRTG Network Monitor logs for sensor errors containing plaintext passwords. Review sensor configurations for unauthorized use of %windowspassword placeholder. Inspect error outputs from demo EXE/Script sensors for type-mismatch errors exposing sensitive data.

Impact Analysis

If exploited, this vulnerability allows unauthorized users with sensor creation rights to obtain the plaintext Windows/domain password used by PRTG. This could lead to further attacks like lateral movement, privilege escalation, or unauthorized access to network resources. The impact depends on the privileges of the compromised account.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing sensitive credentials. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. Unauthorized access to passwords may result in data breaches, leading to regulatory penalties and reputational damage.

Mitigation Strategies

Upgrade PRTG Network Monitor to version 26.2.120.1449 or later. Restrict sensor creation permissions to trusted users only. Remove or disable the demo EXE/Script sensor if not required. Review and audit existing sensor configurations for unauthorized password exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4638. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart