---
id: "CVE-2018-9276"
kind: "vulnerability"
aliases: ["CVE-2018-9276"]
title: "paessler prtg network monitor: An issue was discovered in PRTG Network Monitor before 18.2.39"
severity: "critical"
cvss: 9.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "paessler prtg network monitor", "fixed": ["18.2.39"], "affected": "< 18.2.39", "ecosystem": "vendor"}, {"name": "paessler prtg network monitor", "fixed": ["21.2.68"], "affected": "> 19.3.52, < 21.2.68", "ecosystem": "vendor"}, {"name": "Paessler PRTG Network Monitor", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "paessler-prtg", "self-hosted", "windows"]
not_affected_if: ["no-admin-console-exposure"]
published_at: "2018-07-02T16:29:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-9276", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9276", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# paessler prtg network monitor: An issue was discovered in PRTG Network Monitor before 18.2.39

Paessler PRTG Network Monitor has an OS command injection flaw in its System Administrator web console. An attacker with administrative access can run arbitrary operating system commands on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:paessler prtg network monitor affected < 18.2.39 fixed 18.2.39
- vendor:paessler prtg network monitor affected > 19.3.52, < 21.2.68 fixed 21.2.68
- vendor:Paessler PRTG Network Monitor affected ? fixed ?

## Fix

Apply the vendor mitigations per Paessler instructions, or discontinue use of PRTG if mitigations are unavailable (per CISA KEV required action).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-9276
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-9276

## From the sources

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_