# CVE-2026-86091: ntopng privilege escalation in pools bulk-delete endpoint

Source: https://junglewise.ai/threats/cve-2026-86091-ntopng-privilege-escalation-in-pools-bulk-delete-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86091 · Severity: high · CVSS 7.1 · Published 2026-09-04

ntopng is a web-based network traffic monitoring tool used by organizations to monitor network security and performance. A privilege escalation vulnerability allows authenticated regular users to delete all host pools and traffic policies managed by administrators, disrupting network visibility and traffic control policies that protect the organization from unauthorized traffic.

Technologies: [Ntopng](https://junglewise.ai/threats/technologies/ntopng). Vendors: [Ntop](https://junglewise.ai/threats/vendors/ntop).

## Quick answers

**Is CVE-2026-86091 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86091 being exploited in the wild.

**How severe is CVE-2026-86091?** High severity, with a CVSS score of 7.1, published 4 September 2026.

**Which products and versions are affected?** Ntopng before 6.7.260717.

**Is there a fix for CVE-2026-86091?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86091 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86091?** Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ntopng before version 6.7.260717 fails to validate user privileges in the pools bulk-delete REST endpoint, allowing authenticated non-administrator users to delete all host pools and associated member bindings. The vulnerable code is in scripts/lua/modules/pools/pools_rest_utils.lua, which processes POST requests to the delete pools endpoint without performing adequate authorization checks. An authenticated attacker can send bulk-delete requests to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions. This is a privilege escalation vulnerability requiring authentication but no additional user interaction. Patches are available in version 6.7.260717 and later.

## Affected products

- ntop ntopng before 6.7.260717

## Timeline

- 2026-09-04: disclosed

## References

- [https://github.com/ntop/ntopng](https://github.com/ntop/ntopng)
- [https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua](https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/modules/pools/pools_rest_utils.lua)

## Related threats

- [ntopng stack buffer overflow in nDPI custom category detection](https://junglewise.ai/threats/cve-2026-97371-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng OS command injection in vulnerability-scan REST endpoint](https://junglewise.ai/threats/cve-2026-82413-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng authorization bypass in system configuration backup download](https://junglewise.ai/threats/cve-2026-84990-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng missing authorization check in blacklist editor](https://junglewise.ai/threats/cve-2026-83621-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng remote code execution via unauthenticated scan endpoints](https://junglewise.ai/threats/cve-2026-82412-ntopng-is-a-web-based-network-traffic-monitoring-application)