What is the CVSS score of CVE-2026-38968?

CVE-2026-38968 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ntopng are affected by CVE-2026-38968?

ntopng versions through 6.6 contain a critical session hijacking vulnerability (CVSS 9.8) where authentication tokens are generated with weak randomness, allowing attackers to forecast valid session…

How to fix or mitigate CVE-2026-38968?

Within 24 hours: Inventory all ntopng deployments with versions 6.6 or earlier; restrict administrative access via firewall rules limiting to trusted networks and VPN only. Within 7 days: Implement compensating controls including network segmentation, WAF rules for session fixation detection, and forced re-authentication for sensitive configuration changes. Within 30 days: Monitor vendor advisories for patch availability; prepare and execute upgrade plan when released; if vendor patch timeline extends beyond 90 days, evaluate alternative network monitoring platforms.

ntopng CVE-2026-38968

CRITICAL

Predictable from Observable State (CWE-341)

2026-07-02 mitre

Information Disclosure N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Remote and unauthenticated (AV:N/PR:N), but predicting a time-seeded ID tied to a victim login raises complexity (AC:H); session takeover yields full C/I of the account, no direct availability loss (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 18:28 vuln.today

CVSS changed

Jul 06, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 02, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

AnalysisAI

Session hijacking in ntopng versions through 6.6 arises because HTTP session identifiers are generated with weak, time-seeded pseudo-randomness in src/HTTPserver.cpp, making freshly issued authenticated session cookies predictable or collision-prone. Remote attackers who can influence or observe login timing can forecast a valid session token and take over an authenticated user's session without credentials. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile) despite the 9.8 CVSS rating.

Technical ContextAI

ntopng is an open-source, high-speed network traffic monitoring and flow-analysis tool with an embedded HTTP(S) web console for administration and dashboards. The flaw sits in that embedded web server's session-management code (src/HTTPserver.cpp), where the session identifier issued on successful login is derived from a pseudo-random generator seeded from the current time rather than a cryptographically secure random source. This maps to CWE-341 (Predictable from Observable State): because the seed is derived from observable/controllable time, the resulting session ID space is small and deterministic, so an attacker who knows or forces the login moment can reconstruct or collide with the victim's cookie. The vendor CPE string (cpe:2.3:a:n/a:n/a) is a placeholder and provides no additional product/version precision beyond the description.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the corrected session-ID generation from ntop's commits 179a346ceb6239fd36128ccca3efa8f9ea61eeb5 and 14e22497233dc7d31d19dccb74b13bb073d16c2c by upgrading to a build that incorporates them (track ntop's release notes for the first tagged release past 6.6 that includes these fixes, as an exact patched version number is not confirmed in the provided data). Until a fixed build is deployed, reduce exposure by restricting access to the ntopng web interface: bind the console to localhost or a management VLAN and place it behind a reverse proxy or firewall that limits the admin port to trusted source IPs (trade-off: remote operators lose direct access and must use a VPN/bastion). Enforce HTTPS and short session lifetimes, and consider fronting authentication with the reverse proxy's own session layer so ntopng's predictable cookie is not the sole trust anchor (trade-off: added operational complexity and potential double-login). See the VulDB advisory (https://vuldb.com/vuln/376004) and the linked commits for authoritative detail.