CVE-2026-4637: Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor
Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \".htm\", the web interface returns an HTTP 403 \"Forbidden Path\" error page that echoes the requested URL path into the HTML response body without proper output encoding or sanitization.
An unauthenticated, remote attacker can craft a URL containing an HTML/JavaScript payload in the path (e.g. https:////welcome.htm) and, once a victim with an active PRTG session opens the crafted link, execute arbitrary JavaScript in the security context of the PRTG web interface. Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation allows the attacker to read and exfiltrate the victim's session cookie, potentially leading to session hijacking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paessler PRTG Network Monitorto a version that resolves this vulnerability.Fixed in 26.2.120.1449
Event History
Frequently Asked Questions
Which deployments are exposed?
Paessler PRTG Network Monitor deployments running a version before 26.2.120.1449 are affected through the web interface. The issue is reachable remotely and does not require the attacker to authenticate.
What must an attacker do to exploit this?
The attacker must craft a URL whose path targets a non-existent resource ending in ".htm" and contains an HTML or JavaScript payload. A victim with an active PRTG session must open that link for the payload to execute in the PRTG web interface context.
Why does an active victim session matter?
The injected script executes with the victim's PRTG web-interface security context. Because the session cookie is not protected by the HttpOnly attribute, the script can read and exfiltrate it, potentially enabling session hijacking.