High severity · published Sep 4, 2026
CVE-2026-86091
ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NT
ntopng · ntop
before 6.7.260717 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86091
github.com
https://github.com/ntop/ntopng
github.com
https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua
github.com
https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/pools.lua
github.com
https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8
github.com
https://github.com/ntop/ntopng/security/advisories/GHSA-m22w-f647-vx88
www.vulncheck.com
https://www.vulncheck.com/advisories/ntopng-before-6.7.260717-missing-authorization-on-the-host-pool-bulk-delete-handler
More from ntopng
9.8
CVE-2026-38968
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking
8.8
CVE-2026-84990
ntopng: Missing Authorization on System Configuration Backup Download and Listing
8.8
CVE-2026-82412
ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API
8.8
CVE-2017-5473
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by…
8.1
CVE-2026-83621
ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs