---
id: CVE-2026-4638
title: >-
  PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script
  sensor that multiplies two integer parameters using cscript.exe
summary: >-
  PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script
  sensor that multiplies two integer parameters using cscript.exe. If a
  non-numeric value is passed instead, cscript.exe raises a 'Type mismatch'
  runtime error that …
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-209
vendor: Paessler GmbH
product: PRTG Network Monitor
affected:
  - prtg_network_monitor < 26.2.120.1449
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4638'
references:
  - url: 'https://paessler.freshdesk.com/en/support/solutions/articles/76000088640'
    label: 551230f0-3615-47bd-b7cc-93e92e730bbf
  - url: 'https://r.sec-consult.com/paessler'
    label: 551230f0-3615-47bd-b7cc-93e92e730bbf
  - url: 'https://www.paessler.com/de/download/'
    label: 551230f0-3615-47bd-b7cc-93e92e730bbf
  - url: 'https://www.paessler.com/prtg/prtg-network-monitor'
    label: 551230f0-3615-47bd-b7cc-93e92e730bbf
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T12:13:17.297572Z'
cvssSource: cna
ingestedAt: '2026-09-24T11:42:06.843Z'
epss: 0.00268
epssPercentile: 0.16901
---

## Overview

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter. 




Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.