CVE-2018-9276 Paessler PRTG Network Monitor OS Command Injection

Exploited in the wild High 7.2 Published 2 Jul 2018 Updated 21 Oct 2025

Administrators can execute arbitrary OS commands via malformed parameters in sensor or notification management, requiring admin access.

Exploited in the wild: Since 4 Feb 2025
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-9276?

CVE-2018-9276 is a high-severity command injection vulnerability in n/a, published on 2 Jul 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

Weakness: CWE-78

Which versions are affected by CVE-2018-9276?

It affects 1 product.

Products include Paessler Prtg Network Monitor.

How do I fix CVE-2018-9276?

No fix has been published for CVE-2018-9276 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Feb 2025.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2018-9276 being exploited?

Yes. Attackers have exploited CVE-2018-9276 in the wild since at least 4 Feb 2025.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 5 proofs of concept on GitHub.

Sources

Also known as GHSA-cjqq-8xv6-575p.