CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor
An attacker can execute arbitrary JavaScript via a crafted URL, stealing session cookies and hijacking user accounts in PRTG Network Monitor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-4637?
CVE-2026-4637 is a medium-severity cross-site scripting vulnerability in Paessler GmbH PRTG Network Monitor, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \".htm\", the web interface returns an HTTP 403 \"Forbidden Path\" error page that echoes the requested URL path into the HTML response body without proper output encoding or sanitization.
An unauthenticated, remote attacker can craft a URL containing an HTML/JavaScript payload in the path (e.g. https:////welcome.htm) and, once a victim with an active PRTG session opens the crafted link, execute arbitrary JavaScript in the security context of the PRTG web interface. Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation allows the attacker to read and exfiltrate the victim's session cookie, potentially leading to session hijacking.
Weakness: CWE-79
Which versions are affected by CVE-2026-4637?
How do I fix CVE-2026-4637?
No fix has been published for CVE-2026-4637 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-4637 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4637 exists.
Sources
Also known as GHSA-xp6x-3pcm-f3ph.