ntopng CVE-2026-86091

Exploitation requires a valid ntopng user account with at least low-privilege authentication (PR:L); administrator credentials are not needed. Network access to the ntopng web interface or REST API is required (AV:N). No special configuration beyond having non-administrator user accounts enabled in ntopng is necessary - the vulnerable endpoint is reachable by any authenticated session in the default configuration. Unauthenticated attackers cannot exploit this flaw. The destructive impact is scoped to host pool configuration; network traffic data confidentiality is not directly compromised. The irreversibility of the delete operation (no built-in undo) is a key severity factor.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L reflects a medium-high integrity threat requiring only low-privilege authentication with no attack complexity barrier. The primary mitigating factor is the PR:L requirement - valid credentials are mandatory, which substantially narrows the exploitable population compared to unauthenticated vulnerabilities. The impact is destructive but scoped: all host pools and policy bindings are permanently deleted, which can silently disable traffic segmentation and blunt security monitoring without triggering obvious alerts. No CISA KEV listing and no public PoC have been identified, suggesting no observed active exploitation at time of analysis. EPSS data was not provided. The systemic nature of the patch - fixing three separate delete endpoints in one commit - suggests the authorization gap may extend beyond pools to endpoints and notification recipients, though only the pools handler is attributed in this CVE.

An analyst or read-only ntopng user account - or a threat actor who has compromised such credentials via phishing or credential stuffing - authenticates to the ntopng REST API and issues a POST request to the bulk-delete pools endpoint. Without any server-side capability validation, ntopng processes the request and permanently deletes all host pool definitions and member bindings. This destroys traffic policy enforcement and monitoring segmentation, potentially allowing unrestricted data flows and eliminating visibility into host-pool-scoped traffic analytics.