# CVE-2026-4638: Paessler PRTG Network Monitor password disclosure in demo sensor

Source: https://junglewise.ai/threats/cve-2026-4638-prtg-network-monitor-before-version-26-2-120-1449-ships-a-demo-exe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-4638 · Severity: info · Published 2026-09-24

Paessler PRTG Network Monitor is a network monitoring and management system used by over 500,000 organizations. A vulnerability in a bundled demo sensor script allows any user with sensor creation privileges (the default for non-read-only accounts) to extract the plaintext Windows domain password stored in PRTG configuration. An attacker with valid PRTG credentials could exploit this to obtain domain credentials and escalate privileges across the monitored network infrastructure.

Technologies: [Paessler PRTG Network Monitor](https://junglewise.ai/threats/technologies/prtg-network-monitor). Vendors: [Paessler](https://junglewise.ai/threats/vendors/paessler).

## Quick answers

**Is CVE-2026-4638 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4638 being exploited in the wild.

**How severe is CVE-2026-4638?** Informational severity, published 24 September 2026.

**Which products and versions are affected?** Paessler PRTG Network Monitor before 26.2.120.1449.

**Is there a fix for CVE-2026-4638?** A patch was published on 2026-06-03: Fixed in version 26.2.120.1449 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4638 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-4638?** Check whether you run Paessler PRTG Network Monitor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The demo VBScript sensor for multiplying two integers passes user-supplied parameters to cscript.exe without sanitization. When a non-numeric value is passed, cscript.exe raises a Type Mismatch error that includes the parameter value in plaintext. The %windowspassword placeholder variable, documented in PRTG, resolves to the configured domain password. An authenticated attacker with sensor creation permissions can pass %windowspassword as a sensor argument to trigger this error and display the plaintext password in sensor output, requiring only valid PRTG authentication and no additional user interaction.

## Affected products

- Paessler PRTG Network Monitor before 26.2.120.1449

## Timeline

- 2026-01-29: disclosed: Vulnerability reported to vendor
- 2026-06-03: patched: Fixed in version 26.2.120.1449
- 2026-09-24: advisory: Public disclosure of CVE-2026-4638

## References

- [https://paessler.freshdesk.com/en/support/solutions/articles/76000088640](https://paessler.freshdesk.com/en/support/solutions/articles/76000088640)
- [https://r.sec-consult.com/paessler](https://r.sec-consult.com/paessler)

## Related threats

- [Paessler PRTG Network Monitor reflected XSS in error responses](https://junglewise.ai/threats/cve-2026-4637-paessler-prtg-network-monitor-before-version-26-2-120-1449-is)
- [Paessler PRTG cross-site scripting in body class](https://junglewise.ai/threats/cve-2023-28148-paessler-prtg-cross-site-scripting-in-body-class)
- [Paessler PRTG Network Monitor arbitrary file write via FTP Server Count Sensor](https://junglewise.ai/threats/cve-2023-22632-paessler-prtg-network-monitor-arbitrary-file-write-via-ftp-server)
- [Paessler PRTG Network Monitor arbitrary file write in HTTP XML/REST Sensor](https://junglewise.ai/threats/cve-2023-22631-paessler-prtg-network-monitor-arbitrary-file-write-in-http-xml)
- [Paessler PRTG Network Monitor Local File Inclusion Vulnerability](https://junglewise.ai/threats/cve-2018-19410-paessler-prtg-network-monitor-local-file-inclusion-vulnerability)