Read the docs
TI-2026-04039 Aliases CVE-2026-4637GHSA-xp6x-3pcm-f3ph

Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor

Priority MEDIUM 62CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \".htm\", the web interface returns an HTTP 403 \"Forbidden Path\" error page that echoes the requested URL path into the HTML response body without proper output encoding or sanitization. An unauthenticated, remote attacker can craft a URL containing an HTML/JavaScript payload in the path (e.g. https:////welcome.htm) and, once a victim with an active PRTG session opens the crafted link, execute arbitrary JavaScript in the security context of the PRTG web interface. Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation allows the attacker to read and exfiltrate the victim's session cookie, potentially leading to session hijacking.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Fix Fixed PRTG Network Monitor (Paessler GmbH): 26.2.120.1449

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PaesslerPRTG Network Monitorbefore 26.2.120.144926.2.120.1449Patch availableCNA
  • PRTG Network Monitor VendorPaessler Affected before 26.2.120.1449 Fixed in 26.2.120.1449 Patch available CNA

Remediation

  • Fix · CNA PRTG Network Monitor (Paessler GmbH) Fixed in 26.2.120.1449

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Paessler PRTG Network Monitor — paessler.freshdesk.com/en/support/solutions/articles/760000…

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-04040 Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network MonitorPriority LOW 31
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4637
  2. 2026-10-03 Alias added: GHSA-xp6x-3pcm-f3ph

References

Patch 1

Advisory 2

Other 1

  • TI-2018-13743 PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-06724 An issue was discovered in PRTG Network Monitor before 18.2.39. KEVCVSS 3.1HIGH 7.2
  • TI-2023-16035 A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom… CVSS 3.1HIGH 7.2
  • TI-2022-16181 PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s… CVSS 3.1MEDIUM 5.3
  • TI-2020-09265 PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to… CVSS 3.1MEDIUM 5.3
  • TI-2020-08308 A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows… CVSS 3.1CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences