73,811 reachable PRTG instances: two flaws fixed in 26.2.120.1449

Paessler fixed CVE-2026-4637 (reflected XSS in error handling) and CVE-2026-4638 (stored domain password leak via script sensor output) in PRTG 26.2.120.1449, released June 3, 2026. A ZoomEye query found 73,811 internet-reachable PRTG assets, but the number running vulnerable builds remains unknown.

• CVE-2026-4637 is reflected XSS requiring a signed-in victim
• CVE-2026-4638 leaks %windowspassword via a VBScript error
• Fixed in 26.2.120.1449, released 2026-06-03
• ZoomEye: 73,811 reachable PRTG assets, vulnerable count unknown