VULNERABILITY INTELLIGENCE
CVE-2026-86091
CVSS score7.1 HIGH
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Description
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
Weakness classification
- disclosure@vulncheck.com: CWE-862