CVE-2026-4637: Paessler PRTG Network Monitor XSS Vulnerability

CVE-2026-4637 Overview

CVE-2026-4637 is a reflected Cross-Site Scripting (XSS) vulnerability in Paessler PRTG Network Monitor versions prior to 26.2.120.1449. The PRTG web interface returns an HTTP 403 "Forbidden Path" error page when a request targets a non-existent resource ending in .htm. That error page echoes the requested URL path into the HTML response body without proper output encoding or sanitization. An unauthenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in the context of the PRTG web interface when opened by a victim with an active session. The weakness is tracked under [CWE-79].

Critical Impact
Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation lets attackers read and exfiltrate the victim's session cookie, enabling session hijacking of authenticated PRTG users.

Affected Products

Paessler PRTG Network Monitor versions before 26.2.120.1449
PRTG web interface component handling .htm request routing
Deployments where authenticated users may click external links

Discovery Timeline

2026-09-24 - CVE CVE-2026-4637 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-4637

Vulnerability Analysis

The flaw resides in the PRTG web interface error-handling logic for requests targeting non-existent .htm resources. When the server returns an HTTP 403 "Forbidden Path" response, it reflects the requested URL path directly into the HTML body of the error page. The server performs no HTML entity encoding or input sanitization on this reflected content. An attacker can therefore inject HTML and JavaScript into the path portion of a URL, and that payload becomes active markup in the browser of any user who requests it. The impact is amplified because the PRTG session cookie lacks the HttpOnly flag, allowing JavaScript running in the page context to read document.cookie and transmit the session identifier to an attacker-controlled host.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79] within the 403 error template. User-supplied path data is concatenated into the response HTML without context-appropriate encoding. A secondary configuration weakness, the absence of the HttpOnly cookie attribute on the PRTG session cookie, elevates the consequence from script execution to credential theft.

Attack Vector

Exploitation requires user interaction. An unauthenticated attacker crafts a URL against a target PRTG instance that includes an HTML or JavaScript payload inside a path component ending in .htm. The attacker then delivers the link through phishing, chat, or other social channels. When an authenticated PRTG user opens the link, the injected script executes in the origin of the PRTG web interface. The script can read the session cookie, perform authenticated actions on behalf of the victim, or exfiltrate sensitive monitoring data visible to that user. See the SEC Consult Vulnerability Advisory for PRTG and the Paessler Freshdesk Support Article for additional technical context.

Detection Methods for CVE-2026-4637

Indicators of Compromise

Web server access logs containing requests for .htm paths with URL-encoded <script>, onerror=, javascript:, or event-handler fragments.
HTTP 403 responses tied to unusually long or malformed URL paths against the PRTG web interface.
Outbound requests from browsers to unfamiliar hosts carrying PRTG session cookie values in query strings or request bodies.

Detection Strategies

Inspect reverse-proxy and PRTG access logs for request paths containing angle brackets, encoded HTML entities, or JavaScript keywords.
Correlate 403 "Forbidden Path" responses from PRTG with subsequent authenticated API activity from the same session cookie but a different source IP.
Deploy a web application firewall signature that blocks reflected XSS patterns on URI paths targeting the PRTG host.

Monitoring Recommendations

Alert on session reuse where a PRTG session cookie appears from two distinct source IPs within a short window.
Monitor administrator-level PRTG actions (sensor changes, user creation, credential exports) and require review when they follow a 403 event.
Track external referrers landing on PRTG .htm URLs to identify phishing-driven exploitation attempts.

How to Mitigate CVE-2026-4637

Immediate Actions Required

Upgrade PRTG Network Monitor to version 26.2.120.1449 or later using the Paessler Download Page.
Invalidate all active PRTG sessions after upgrading and require users to re-authenticate.
Restrict exposure of the PRTG web interface to trusted networks or VPN access until patching is complete.

Patch Information

Paessler has released a fixed build in PRTG Network Monitor 26.2.120.1449. Review the Paessler Freshdesk Support Article and the SEC Consult Analysis on Paessler for vendor and researcher guidance. Product information is available on the Paessler PRTG Network Monitor Overview page.

Workarounds

Place PRTG behind a reverse proxy that strips or rejects URL paths containing HTML metacharacters.
Enforce the HttpOnly and Secure attributes on PRTG session cookies at the proxy layer to reduce cookie theft risk.
Train administrators to avoid clicking unsolicited links that reference internal PRTG hostnames.

bash

# Example NGINX reverse-proxy rule blocking suspicious .htm paths
location ~* \.htm$ {
    if ($request_uri ~* "(<|>|%3C|%3E|script|onerror=|javascript:)") {
        return 400;
    }
    proxy_pass https://prtg.internal;
    proxy_cookie_flags ~ HttpOnly Secure;
}