ntopng CVE-2026-86090

Exploitation requires an authenticated ntopng session for any non-administrator user account - no additional privileges, role assignments, or special configuration beyond possessing a valid login are needed. The REST v2 API must be network-accessible to the attacker (default ntopng deployment exposes the web interface and API on port 3000). Limiting factors: unauthenticated exploitation is not possible (PR:L confirmed by CVSS vector); if the ntopng instance has only administrator accounts configured with no lower-privilege user accounts, the attack surface is eliminated. The delete operations are irreversible without manual reconfiguration of all endpoints and recipients, amplifying operational impact.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H) accurately captures the primary risk: high availability impact against the monitoring system itself, with low integrity impact and no confidentiality exposure. Real-world severity is moderate-to-significant for any organization that depends on ntopng's alerting pipeline - even a mid-sized municipal IT team in leszno relying on ntopng for network visibility could find their alert infrastructure silently wiped by a disgruntled or compromised low-privilege account, leaving the network blind with no indication of the sabotage. The attack is fully automatable (AC:L, UI:N) and requires only a valid session, meaning any insider or attacker who has obtained any ntopng credential can execute it without elevated privilege. No KEV listing and no public POC reduce the urgency relative to a weaponized vulnerability, but the trivial exploit path and irreversible impact (all alert configs deleted, not just disabled) elevate operational risk beyond what the mid-range score alone suggests.

An attacker who has obtained any valid ntopng user credential - through phishing, credential stuffing, or insider access - sends a POST request to /api/v2/delete/endpoints followed by a POST to /api/v2/delete/recipients. Both requests succeed without administrator privileges, wiping all alert notification configurations. The organization's ntopng instance continues to run and collect traffic data normally, but generates no alerts for any subsequent security events, effectively blinding the SOC without triggering any immediate visible error or log entry visible to administrators.