PRTG Network Monitor CVE-2026-4637

Exploitation requires (1) a request to a non-existent resource whose path ends in '.htm', which triggers the vulnerable 403 'Forbidden Path' error page that echoes the URL path unencoded, and (2) a victim who already holds an active, authenticated PRTG session and clicks the attacker-crafted link (UI:A / user interaction is mandatory - the attacker alone cannot trigger impact). The elevated impact (session hijacking) additionally depends on PRTG serving its session cookie without the HttpOnly attribute, which is the default/affected behavior below 26.2.120.1449. Limiting factors: reflected (non-persistent) XSS requiring social engineering of a logged-in user; no server-side compromise or data alteration on PRTG itself.

This is a moderate, not high-priority, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 5.1) tells a consistent story: a reflected XSS that is network-reachable and unauthenticated to launch, but that hinges on victim interaction (UI:A) - the attacker cannot execute anything until a logged-in PRTG user opens the crafted link. Vulnerable-system impact is explicitly None (VC/VI/VA:N); the harm is captured only in subsequent-system Low (SC:L/SI:L), reflecting that JavaScript runs in the victim's browser session context rather than compromising the PRTG server directly. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automatable mass exploitation - the E:X (Not Defined) exploit-maturity field is unset. The real-world severity is bounded by the reflected (non-persistent) nature and the requirement to socially engineer an authenticated victim. That said, the non-HttpOnly session cookie meaningfully raises the practical impact from generic XSS to session hijacking of a network-monitoring console, which typically holds broad infrastructure credentials/visibility. Net: a genuine bug worth patching on a normal cycle, but not an emergency; the modest CVSS reflects the real risk rather than overstating it.

An attacker crafts a URL to a non-existent .htm resource on a target PRTG instance with a JavaScript payload embedded in the path (e.g. https://prtg.example/<script>...</script>welcome.htm), which the 403 'Forbidden Path' page reflects unencoded into the HTML body. The attacker delivers this link to a PRTG administrator via phishing; when that logged-in victim clicks it, the script executes in the PRTG web-interface origin and reads the non-HttpOnly session cookie, exfiltrating it for session hijacking. No public exploit code was identified, and success requires the victim to have an active PRTG session and to open the link.