CVE-2026-4638 in PRTG Network Monitor
Summary
by MITRE • 09/24/2026
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.
Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified involves a critical information disclosure flaw within PRTG Network Monitor prior to version 26.2.120.1449, specifically affecting the demo EXE/Script sensor functionality. This component is designed to execute external scripts or executables as part of its monitoring capabilities, utilizing cscript.exe for VBScript execution. The core technical flaw lies in the lack of input validation when processing integer parameters passed to this script-based sensor. When a non-numeric value is supplied instead of an expected integer, the underlying scripting engine encounters a type mismatch error during arithmetic operations. Crucially, rather than displaying a generic or sanitized error message, the runtime environment exposes the exact offending parameter in plaintext within the exception output generated by cscript.exe. This behavior creates a direct vector for sensitive data leakage when combined with specific configuration features of PRTG Network Monitor.
The operational impact is significantly amplified by the availability of documented placeholder variables within the PRTG ecosystem. One such variable, %windowspassword, resolves to the Windows or domain password configured for authentication purposes and can be passed as a sensor parameter without explicit validation against its sensitive nature. An attacker with any level of access that permits the creation or modification of sensors, which is the default configuration for non-read-only users in many deployments, can exploit this mechanism. By intentionally passing %windowspassword as an argument to the vulnerable demo VBScript sensor, the user triggers the type mismatch error condition. Consequently, PRTG displays the plaintext password within the sensor's error output, effectively exposing credentials that are typically treated with high confidentiality. This represents a severe breach of credential security principles, allowing unauthorized users to harvest administrative or service account passwords simply by creating a misconfigured monitoring object.
From a classification perspective, this vulnerability aligns closely with CWE-209, which describes the generation of an error message that includes sensitive information useful for an attacker, such as stack traces, paths, or in this case, plaintext credentials. It also relates to CWE-78, Improper Neutralization of Special Elements used in an OS Command, although the primary impact here is data exposure rather than command injection. In terms of adversary tactics, this flaw facilitates Credential Access techniques outlined in the MITRE ATT&CK framework, specifically T1098, Account Manipulation or more directly T1528, Steal Application Access Token if combined with other vectors, but primarily it serves as a direct method for stealing credentials through application logic flaws. The attack vector is classified as Local because it requires an authenticated user account within the PRTG interface, though the scope of damage extends to all systems accessible by those stolen credentials.
Mitigation strategies must address both the immediate vulnerability and broader access control practices. The primary remediation is to upgrade PRTG Network Monitor to version 26.2.120.1449 or later, where this input validation issue has been resolved. For environments unable to patch immediately, administrators should restrict sensor creation permissions exclusively to a minimal set of highly trusted administrative accounts rather than the default broader group. Additionally, organizations should audit existing sensors for any usage of sensitive placeholder variables in script parameters and remove them if not strictly necessary. Implementing strict input validation on all custom scripts executed by PRTG is also recommended to prevent similar type-related information leaks. Regularly rotating credentials associated with %windowspassword after such an incident or as a proactive measure helps limit the window of exposure should this vulnerability be exploited in unpatched systems.