CVE-2026-86091highCWE-862

CVE-2026-86091: fallo de gravedad alta en ntopng

ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ntopng

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.5%
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
ntop · ntopng
CVEs relacionadas — ntopng

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-82413HIGHntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)EPSS 1.1%CVE-2026-82412HIGHntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIEPSS 0.7%CVE-2026-83621HIGHntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLsEPSS 0.5%CVE-2026-97371MEDIUMntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packetsEPSS 0.5%CVE-2026-86090HIGHntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete HandlersEPSS 0.5%CVE-2026-84989HIGHntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary TagsEPSS 0.4%