CVE-2026-4638: PRTG Network Monitor Password Disclosure

CVE-2026-4638 Overview

CVE-2026-4638 is an information disclosure vulnerability in Paessler PRTG Network Monitor before version 26.2.120.1449. The flaw resides in the shipped demo EXE/Script sensor, which multiplies two integer parameters using cscript.exe. When a non-numeric value is supplied, cscript.exe raises a Type mismatch runtime error that echoes the offending parameter value in plaintext. PRTG exposes a documented placeholder, %windowspassword, which resolves to the configured Windows or domain password used by PRTG. Any authenticated user permitted to create sensors can abuse this placeholder to disclose the password in the sensor's error output.

Critical Impact
Low-privileged PRTG users without read-only restrictions can extract the plaintext Windows/domain credentials configured in PRTG by crafting a demo VBScript sensor that triggers a type-mismatch error.

Affected Products

Paessler PRTG Network Monitor versions prior to 26.2.120.1449
Deployments shipping the default demo EXE/Script VBScript sensor
PRTG instances where non-read-only users retain the default sensor-creation permission

Discovery Timeline

2026-09-24 - CVE-2026-4638 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-4638

Vulnerability Analysis

The vulnerability is an information exposure through an error message, classified as [CWE-209]. PRTG ships a demo VBScript sensor that invokes cscript.exe to multiply two integer arguments passed from the sensor configuration. The script performs no input validation before the arithmetic operation. When a user supplies a non-numeric argument, the VBScript runtime raises a Type mismatch error and includes the raw value of the offending argument in the error text. PRTG then stores and displays this message as the sensor's error output, which is readable through the standard PRTG web interface.

The security impact stems from how PRTG resolves template placeholders before executing the sensor script. The %windowspassword placeholder is a documented variable that PRTG substitutes with the Windows or domain password associated with the parent device or group. Because substitution occurs prior to script execution, the resolved plaintext password is passed on the command line to cscript.exe and subsequently surfaces in the runtime error returned to the user interface.

Root Cause

The root cause is a combination of unsafe handling of sensitive placeholders and verbose error reporting. The demo VBScript expands %windowspassword into the argument stream without masking, and the runtime error path returns the parameter value verbatim. PRTG also grants sensor-creation rights to all non-read-only users by default, broadening the population of accounts able to trigger disclosure.

Attack Vector

An authenticated PRTG user with the default permission to create sensors adds a new EXE/Script sensor based on the demo VBScript. The attacker configures the sensor so that one of the two numeric arguments is set to the literal placeholder %windowspassword. On execution, PRTG resolves the placeholder to the configured plaintext credential and passes it to cscript.exe. Because the value is not numeric, the script raises a Type mismatch error containing the password, which PRTG then displays in the sensor's status message. See the Sec-Consult Paessler Analysis for the full technical write-up.

Detection Methods for CVE-2026-4638

Indicators of Compromise

Newly created EXE/Script or VBScript sensors referencing the demo multiplication script with non-numeric parameter values
Sensor error messages containing Microsoft VBScript runtime error and Type mismatch strings in PRTG logs
Sensor parameters that include the literal token %windowspassword or other documented credential placeholders

Detection Strategies

Audit the PRTG Logs and Sensor tables for recently created or modified EXE/Script sensors, especially those authored by non-administrative accounts
Correlate audit log entries for sensor creation with subsequent Type mismatch sensor error states on the same object
Review the PRTG web server access logs for API calls to addsensor.htm or editsettings that reference the demo script template

Monitoring Recommendations

Forward PRTG application and audit logs to a centralized log platform for retention and alerting
Alert on any sensor whose last error message contains credential-like high-entropy strings or references to %windowspassword
Monitor PRTG user permission changes that grant sensor-creation rights to additional accounts

How to Mitigate CVE-2026-4638

Immediate Actions Required

Upgrade PRTG Network Monitor to version 26.2.120.1449 or later from the Paessler Download Page
Rotate the Windows and domain credentials configured in PRTG, assuming they may have been exposed
Review all existing EXE/Script sensors for parameters containing %windowspassword or other credential placeholders and remove them
Restrict sensor-creation rights to administrative accounts and set non-trusted users to read-only access

Patch Information

Paessler addressed the issue in PRTG Network Monitor 26.2.120.1449. Refer to the Paessler Support Article for official patch notes and upgrade guidance. The fixed release removes the vulnerable demo script behavior and corrects how sensitive placeholders are handled during sensor execution.

Workarounds

Remove or disable the shipped demo EXE/Script VBScript sensor template on all PRTG probes until the patch is applied
Change the default role assigned to new users so that sensor creation requires explicit administrator approval
Audit custom scripts to ensure credential placeholders are never passed as script arguments and are referenced only through secure channels

bash

# Configuration example: locate and remove the demo VBScript on PRTG probes
# Default path on Windows probe installations
dir "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXE\Demo*.vbs"

# Rename to disable until patched
ren "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXE\Demo Batchfile.vbs" "Demo Batchfile.vbs.disabled"