CVE-2026-86090highCWE-862

CVE-2026-86090: falha de alta gravidade em ntopng

ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ntopng

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.5%
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ntop · ntopng
CVEs relacionadas — ntopng

No mesmo produto, das mais perigosas para as menos.

CVE-2026-82413HIGHntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)EPSS 1.1%CVE-2026-82412HIGHntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIEPSS 0.7%CVE-2026-83621HIGHntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLsEPSS 0.5%CVE-2026-86091HIGHntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete HandlerEPSS 0.5%CVE-2026-97371MEDIUMntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packetsEPSS 0.5%CVE-2026-84989HIGHntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary TagsEPSS 0.4%