Is CVE-2026-83621 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83621 being exploited in the wild.

How severe is CVE-2026-83621?

High severity, with a CVSS score of 8.1, published 21 September 2026.

Is there a fix for CVE-2026-83621?

A patch was published on 2026-09-21: Fixed in version 6.7.260717 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83621 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-83621?

Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83621: ntopng missing authorization check in blacklist editor

CVE-2026-83621 · Severity: high · CVSS 8.1 · Published 2026-09-21

ntopng is a web-based network traffic monitoring tool that tracks and analyzes network activity. A flaw in the threat intelligence blacklist configuration endpoint allows any authenticated user—not just administrators—to redirect downloads to attacker-controlled servers, disable security blocklists, or stop scheduled updates. This undermines the tool's ability to detect and block known threats.

Technologies: Ntopng. Vendors: Ntop.

Quick answers

Is CVE-2026-83621 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83621 being exploited in the wild.
How severe is CVE-2026-83621?: High severity, with a CVSS score of 8.1, published 21 September 2026.
Which products and versions are affected?: Ntopng before 6.7.260717.
Is there a fix for CVE-2026-83621?: A patch was published on 2026-09-21: Fixed in version 6.7.260717 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83621 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-83621?: Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The POST /lua/rest/v2/edit/system/edit_blacklist.lua endpoint lacks an isAdministrator() check, allowing any authenticated user to call lists_utils.editList with arbitrary parameters (list_name, list_enabled, url, list_update). Changes persist via Redis and reload without lower-level authorization guards, enabling privilege escalation from user to threat-intelligence administrator. The fix adds authorization checks matching sibling endpoints.

Affected products

ntop ntopng before 6.7.260717

Timeline

2026-09-21: disclosed
2026-09-21: patched: Fixed in version 6.7.260717

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.