ntopng CVE-2026-38968

Exploitation requires the ntopng web/HTTP server to be reachable by the attacker and a fresh authenticated login to occur that the attacker can time or influence ('under attacker-controlled timing,' per the description) - the weakness is the time-seeded PRNG used for session-cookie creation in src/HTTPserver.cpp. The limiting factor is that the attacker must predict or collide with the seed window tied to a specific victim login, so success depends on how narrow and observable that timing window is; no valid credentials or user interaction from the victim beyond a normal login are needed. This is not a purely no-conditions remote exploit despite the PR:N vector, because the timing dependency raises real-world attack complexity.

The signals conflict and should be weighed carefully. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) treats this as trivially exploitable network-wide, but the description qualifies exploitation as requiring 'attacker-controlled timing,' which argues for higher attack complexity (AC:H) than the published AC:L - the true difficulty depends on how tight the time seed window is and whether the attacker can force or precisely observe a victim login. EPSS is low (0.15%, 5th percentile), the CVE is not on CISA KEV, and no POC is referenced, so there is no evidence of active or imminent mass exploitation. This is best treated as a genuine authentication-bypass-class weakness worth patching promptly on internet-exposed instances, but the real-world urgency is lower than the 9.8 headline implies: the practical bar (predicting a time-seeded value tied to a specific victim login) is meaningfully higher than a no-conditions remote exploit. Verify the effective attack complexity against the actual seeding logic before treating this as drop-everything-critical.

An attacker who can reach the ntopng web console (e.g., an exposed monitoring appliance) triggers or observes an administrator login and, knowing the session ID is seeded from time, computes the small set of candidate cookies and replays a valid one to assume the admin's authenticated session. With that session the attacker reads sensitive network flow/telemetry data and alters monitoring configuration. No POC is referenced, and the practical success rate depends on how precisely the attacker can control or observe login timing.