CVE-2026-86091highCWE-862

CVE-2026-86091: high-severity vulnerability in ntopng

ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

Published · Updated

Follow this CVE+ Monitor ntopng

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.5%
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
ntop · ntopng
Related CVEs — ntopng

In the same product, most dangerous first.

CVE-2026-82412HIGHntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIEPSS 0.7%CVE-2026-83621HIGHntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLsEPSS 0.5%CVE-2026-86090HIGHntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete HandlersEPSS 0.5%CVE-2026-84989HIGHntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary TagsEPSS 0.4%CVE-2026-84990HIGHntopng: Missing Authorization on System Configuration Backup Download and ListingEPSS 0.3%CVE-2026-45448MEDIUMntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.2%