CVE-2026-86091High· 7.1▾ MidnightPoC availablentopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endp…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86090High· 7.1ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers
CVE-2026-83621High· 8.1ntopng is a web-based network traffic monitoring application
CVE-2026-84990High· 8.8ntopng is a web-based network traffic monitoring application
CVE-2026-82412High· 8.8ntopng is a web-based network traffic monitoring application
CVE-2026-16772High· 8.1In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges
CVE-2026-86098High· 7.4ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries