Paessler PRTG Network Monitor OS Command Injection Vulnerability (CVE-2018-9276)
Severity: high · Patch status: unknown · Since 2025-02-04 · CVE-2018-9276
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console. CISA added CVE-2018-9276 to its Known Exploited Vulnerabilities catalog on Feb 4, 2025, which means attackers are exploiting it in the wild.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Feb 25, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
