CVE-2026-4637 in PRTG Network Monitor
Summary
by MITRE • 09/24/2026
Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \".htm\", the web interface returns an HTTP 403 \"Forbidden Path\" error page that echoes the requested URL path into the HTML response body without proper output encoding or sanitization.
An unauthenticated, remote attacker can craft a URL containing an HTML/JavaScript payload in the path (e.g. https:////welcome.htm) and, once a victim with an active PRTG session opens the crafted link, execute arbitrary JavaScript in the security context of the PRTG web interface. Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation allows the attacker to read and exfiltrate the victim's session cookie, potentially leading to session hijacking.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
Paessler PRTG Network Monitor versions prior to 26.2.120.1449 contain a reflected Cross-Site Scripting vulnerability within its web interface that allows unauthenticated remote attackers to execute arbitrary JavaScript code in the context of authenticated users. The flaw is triggered when an attacker crafts a URL targeting a non-existent resource with a .htm extension, such as https://target/welcome.htm. Upon receiving this request, the PRTG application generates an HTTP 403 Forbidden Path error page and inadvertently includes the requested URL path directly within the HTML response body without applying proper output encoding or sanitization mechanisms. This behavior creates a direct injection vector where malicious scripts embedded in the URL are rendered and executed by the victim's browser upon loading the error page.
The technical root cause of this vulnerability lies in the application's failure to escape special characters when echoing user-supplied input back into the HTML document structure. By reflecting the unsanitized path parameter directly into the response, the web server effectively allows an attacker to inject executable script tags or event handlers that bypass standard browser security policies regarding same-origin restrictions. This specific implementation flaw aligns with CWE-79, which classifies improper neutralization of input during web page generation as a critical weakness in web application security frameworks. The lack of context-aware encoding ensures that any HTML special characters present in the crafted URL are interpreted by the browser's rendering engine rather than being treated as literal data.
From an operational perspective, this vulnerability poses a severe risk to session integrity and user confidentiality because it can be exploited without requiring prior authentication credentials from the attacker. An unauthenticated remote actor can distribute malicious links through phishing emails or other social engineering tactics. When a victim with an active PRTG administrative session clicks the crafted link, their browser automatically includes any stored cookies for that domain in the request to fetch the error page. Crucially, the session cookie associated with the PRTG web interface is not configured with the HttpOnly flag, which means it remains accessible via client-side JavaScript APIs such as document.cookie. Consequently, successful exploitation enables an attacker to read and exfiltrate these sensitive cookies, facilitating complete session hijacking attacks where the adversary assumes the identity of the victim user without needing their password or multi-factor authentication tokens.
This attack vector is consistent with ATT&CK technique T1078, specifically referencing valid accounts obtained through phishing or other means, as well as T1566.002 for spearphishing links that lead to credential theft and subsequent unauthorized access. The ability to steal session cookies effectively bypasses authentication controls entirely, allowing the attacker to perform actions with the privileges of the compromised account, including modifying network configurations, viewing sensitive monitoring data, or installing further malicious components within the infrastructure.
To mitigate this vulnerability, organizations running Paessler PRTG Network Monitor must immediately upgrade to version 26.2.120.1449 or later where the issue has been resolved through improved input validation and output encoding practices. In addition to patching, administrators should enforce security best practices by ensuring that all session cookies are marked with the HttpOnly attribute to prevent client-side script access, as well as setting the Secure flag to ensure transmission only over encrypted channels. Implementing a Web Application Firewall can also provide an additional layer of defense by filtering out requests containing suspicious patterns indicative of cross-site scripting attempts before they reach the application logic.