Is CVE-2026-4638 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4638 being exploited in the wild.

How severe is CVE-2026-4638?

Informational severity, published 24 September 2026.

Which products and versions are affected?

Paessler PRTG Network Monitor before 26.2.120.1449.

Is there a fix for CVE-2026-4638?

A patch was published on 2026-06-03: Fixed in version 26.2.120.1449 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4638 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-4638?

Check whether you run Paessler PRTG Network Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4638: Paessler PRTG Network Monitor password disclosure in demo sensor

CVE-2026-4638 · Severity: info · Published 2026-09-24

Paessler PRTG Network Monitor is a network monitoring and management system used by over 500,000 organizations. A vulnerability in a bundled demo sensor script allows any user with sensor creation privileges (the default for non-read-only accounts) to extract the plaintext Windows domain password stored in PRTG configuration. An attacker with valid PRTG credentials could exploit this to obtain domain credentials and escalate privileges across the monitored network infrastructure.

Technologies: Paessler PRTG Network Monitor. Vendors: Paessler.

Quick answers

Is CVE-2026-4638 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4638 being exploited in the wild.
How severe is CVE-2026-4638?: Informational severity, published 24 September 2026.
Which products and versions are affected?: Paessler PRTG Network Monitor before 26.2.120.1449.
Is there a fix for CVE-2026-4638?: A patch was published on 2026-06-03: Fixed in version 26.2.120.1449 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4638 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-4638?: Check whether you run Paessler PRTG Network Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The demo VBScript sensor for multiplying two integers passes user-supplied parameters to cscript.exe without sanitization. When a non-numeric value is passed, cscript.exe raises a Type Mismatch error that includes the parameter value in plaintext. The %windowspassword placeholder variable, documented in PRTG, resolves to the configured domain password. An authenticated attacker with sensor creation permissions can pass %windowspassword as a sensor argument to trigger this error and display the plaintext password in sensor output, requiring only valid PRTG authentication and no additional user interaction.

Affected products

Paessler PRTG Network Monitor before 26.2.120.1449

Timeline

2026-01-29: disclosed: Vulnerability reported to vendor
2026-06-03: patched: Fixed in version 26.2.120.1449
2026-09-24: advisory: Public disclosure of CVE-2026-4638

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.