CVE-2026-86091: Ntop Ntopng

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

Affected products

• Ntop Ntopng: before 6.7.260717 (fixed in 6.7.260717)

Published 2026-09-04. Last modified 2026-09-23.