PRTG Network Monitor EUVD-2026-85847

Requires an authenticated PRTG account that is NOT restricted to read-only and is permitted to create sensors (the default for non-read-only users), plus availability of the demo EXE/Script (VBScript) sensor type that performs integer multiplication via cscript.exe. The attacker must know or use the documented %windowspassword placeholder as a sensor parameter, and a Windows/domain credential must actually be configured in PRTG for a value to leak. Limiting factors: exploitation is gated by that authenticated non-read-only privilege (PR:L) and can be mitigated by removing sensor-creation rights or the demo sensor; no unauthenticated or default-credential path is described, and there is no integrity or availability impact.

This is a genuine but bounded credential-disclosure issue rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) is internally consistent with the description: network-reachable web UI, low attack complexity, requires an authenticated non-read-only account (PR:L), no user interaction, and high confidentiality impact with no integrity or availability effect. The severity driver is that the leaked value is the configured Windows/domain password PRTG uses for its own monitoring - a credential that typically grants meaningful lateral movement, so VC:H is warranted despite CWE-209 being 'just' an error-message leak. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so there is no evidence of active or automated exploitation; the SSVC-style read is exploitation=none, automatable=no (an authenticated create-sensor privilege is required per attempt), technical impact=partial. The realistic exposure is an insider or a foothold-holding attacker who already has a PRTG account escalating to the underlying Windows/domain credential. Note the one caveat: exploitation depends on the demo EXE/Script (VBScript) sensor being available and the account holding sensor-create rights (the default for non-read-only users) - both are default conditions but can be removed by hardening.

An authenticated PRTG user who is not restricted to read-only (the default privilege level) creates or edits a demo EXE/Script VBScript sensor and supplies the documented placeholder %windowspassword as one of the two multiplication parameters. cscript.exe raises a 'Type mismatch' runtime error because the resolved password is non-numeric, and PRTG renders that error - including the plaintext Windows/domain password - in the sensor's error output. No public exploit code is identified in the supplied data, but the technique is fully described in the vendor/researcher advisory.