PRTG patches two flaws in build 26.2.120.1449

Paessler released PRTG Network Monitor build 26.2.120.1449, fixing a reflected XSS (CVE-2026-4637, CVSS 5.1) and credential disclosure in error messages (CVE-2026-4638, CVSS 7.1). SEC Consult reported both; CERT-Bund rates the combined impact 8.1 under CVSS 3.1. All installations below 26.2.120.1449 are affected.

• CVE-2026-4637: reflected XSS via HTTP 403, CVSS 4.0 score 5.1
• CVE-2026-4638: PRTG password echoed in sensor error, CVSS 4.0 score 7.1
• CERT-Bund: WID-SEC-2026-3565, base score 8.1 under CVSS 3.1
• ZoomEye found 73,798 assets with a PRTG fingerprint