Is CVE-2026-86091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86091 being exploited in the wild.

How severe is CVE-2026-86091?

High severity, with a CVSS score of 7.1, published 4 September 2026.

Is there a fix for CVE-2026-86091?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86091 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86091?

Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86091: ntopng privilege escalation in pools bulk-delete endpoint

CVE-2026-86091 · Severity: high · CVSS 7.1 · Published 2026-09-04

ntopng is a web-based network traffic monitoring tool used by organizations to monitor network security and performance. A privilege escalation vulnerability allows authenticated regular users to delete all host pools and traffic policies managed by administrators, disrupting network visibility and traffic control policies that protect the organization from unauthorized traffic.

Technologies: Ntopng. Vendors: Ntop.

Quick answers

Is CVE-2026-86091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86091 being exploited in the wild.
How severe is CVE-2026-86091?: High severity, with a CVSS score of 7.1, published 4 September 2026.
Which products and versions are affected?: Ntopng before 6.7.260717.
Is there a fix for CVE-2026-86091?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86091 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86091?: Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ntopng before version 6.7.260717 fails to validate user privileges in the pools bulk-delete REST endpoint, allowing authenticated non-administrator users to delete all host pools and associated member bindings. The vulnerable code is in scripts/lua/modules/pools/pools_rest_utils.lua, which processes POST requests to the delete pools endpoint without performing adequate authorization checks. An authenticated attacker can send bulk-delete requests to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions. This is a privilege escalation vulnerability requiring authentication but no additional user interaction. Patches are available in version 6.7.260717 and later.

Affected products

ntop ntopng before 6.7.260717

Timeline

2026-09-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.