CVE-2026-4638

Description

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter. Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.

Overview

State: PUBLISHED
Assigner (CNA): SEC-VLab
CVSS severity: HIGH
CVSS score: 7.1 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Effective score: 7.1 / 10 HIGH source: CNA overview
CWE(s): CWE-209
Reserved: 2026-03-23
Published: 2026-09-24 10:57 UTC
Last updated: 2026-09-24 12:14 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/4xxx/CVE-2026-4638.json
Linked Threat: CVE-2026-4638 — Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-24 11:16:45 UTC
NVD last modified: 2026-09-24 20:43:32 UTC

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85847
Assigner: SEC-VLab
Published: Sep 24, 2026, 10:57:54 AM
Updated: Sep 24, 2026, 12:14:20 PM
EUVD base score (CVSS 4.0): 7.1 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: Paessler GmbH
Products: PRTG Network Monitor (0 <26.2.120.1449)
Aliases: GHSA-gh9q-9rjg-9rq2

ENISA description: PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter. Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
Paessler GmbH	PRTG Network Monitor	`0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://r.sec-consult.com/paessler third-party-advisory
https://paessler.freshdesk.com/en/support/solutions/articles/76000088640 vendor-advisory
https://www.paessler.com/de/download/ patch
https://www.paessler.com/prtg/prtg-network-monitor product

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://paessler.freshdesk.com/en/support/solutions/articles/76000088640 551230f0-3615-47bd-b7cc-93e92e730bbf
https://r.sec-consult.com/paessler 551230f0-3615-47bd-b7cc-93e92e730bbf
https://www.paessler.com/de/download/ 551230f0-3615-47bd-b7cc-93e92e730bbf
https://www.paessler.com/prtg/prtg-network-monitor 551230f0-3615-47bd-b7cc-93e92e730bbf

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

XSS2Shell (CVE-2026-64638): WordPress Login Page Pre-Auth XSS to RCE ...

web:brandefense.io

Learn how XSS2Shell ( CVE - 2026 -64638) enables pre-authentication XSS on WordPress login pages and how attackers can chain it to remote code execution. Discover affected versions, detection methods, mitigation steps, and why external attack surface visibility is critical.

2026-09-25 10:11 UTC
CVE-2026-4638: PRTG Network Monitor Vulnerability | CVETodo

web:cvetodo.com

CVE-2026-4638 is a CVSS 7.1 high-severity vulnerability in PRTG Network Monitor. Includes technical details, affected versions, and mitigation steps.

2026-09-25 10:11 UTC
GitHub - 0xBlackash/CVE-2026-64638: CVE-2026-64638

web:github.com

Mitigation & Recommendations 🚨 Update Immediately Upgrade to WordPress 7.0.3 ( or the corresponding security release on your branch). Sites with automatic background updates enabled should receive the fix automatically. Do not rely solely on hardening plugins or CSP as complete mitigation — the core patch is required.

2026-09-25 10:11 UTC
Nvd-cve-2026-64638

web:nvd.nist.gov

Description WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue ...

2026-09-25 10:11 UTC
WordPress 7.0.3 Released: 12 Vulnerabilities Found and Fixed

web:patchstack.com

WordPress 7.0.3 landed on 6 August 2026 . It's a security release with 12 different fixes covering pre-auth cross-site scripting (XSS), stored XSS, privilege esc

2026-09-25 10:11 UTC
XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638) - pwn.ai

web:pwn.ai

Check whether your WordPress site is vulnerable to XSS2Shell ( CVE - 2026 -64638), the pre-authentication RCE in WordPress Core. A free checker from pwn.ai.

2026-09-25 10:11 UTC
XSS2Shell (CVE-2026-64638): Patch WordPress Now

web:socradar.io

What Is XSS2Shell ( CVE - 2026 -64638)? XSS2Shell is the name given to a WordPress pre-authentication "XSS to code execution" vulnerability chain. The underlying WordPress Core vulnerability is CVE - 2026 -64638, a reflected cross-site scripting issue on the login screen. The important point for defenders is that the first stage does not require an attacker account. A crafted failed login flow ...

2026-09-25 10:11 UTC
CVE-2026-64638 Explained: How WordPress Pre-Auth XSS Can Lead to PHP ...

web:thecybersecguru.com

Learn how CVE - 2026 -64638 affects WordPress, why the pre-authentication XSS is dangerous, how researchers chained it to PHP code execution using XSS2Shell

2026-09-25 10:11 UTC
CVE-2026-64638: Critical Pre-Auth XSS Vulnerability in WordPress Allows ...

web:www.rescana.com

Executive SummaryA critical vulnerability has been identified in WordPress—specifically, a pre-authentication reflected Cross-Site Scripting (XSS) flaw tracked as CVE - 2026 -64638. This vulnerability, p

2026-09-25 10:11 UTC
CVE-2026-64638 Impact, Exploitability, and Mitigation Steps | Wiz

web:www.wiz.io

Understand the critical aspects of CVE - 2026 -64638 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

2026-09-25 10:11 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-4638.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T12:13:17.297572Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T12:14:20.861Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PRTG Network Monitor",
          "vendor": "Paessler GmbH",
          "versions": [
            {
              "lessThan": "26.2.120.1449",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "J. Kruchem, SEC Consult Vulnerability Lab"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "S. Michlits, SEC Consult Vulnerability Lab"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<div><span>PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.&nbsp;</span></div><div><span><br></span></div><div><span>Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.</span></div>"
            }
          ],
          "value": "PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.\u00a0\n\n\n\n\nAny PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-54",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-54 Query System for Information"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209 Generation of error message containing sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T10:57:54.203Z",
        "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "shortName": "SEC-VLab"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://r.sec-consult.com/paessler"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://paessler.freshdesk.com/en/support/solutions/articles/76000088640"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.paessler.com/de/download/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.paessler.com/prtg/prtg-network-monitor"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to Paessler PRTG Network Monitor version 26.2.120.1449 or later."
            }
          ],
          "value": "Upgrade to Paessler PRTG Network Monitor version 26.2.120.1449 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
    "assignerShortName": "SEC-VLab",
    "cveId": "CVE-2026-4638",
    "datePublished": "2026-09-24T10:57:54.203Z",
    "dateReserved": "2026-03-23T10:32:11.997Z",
    "dateUpdated": "2026-09-24T12:14:20.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}