CVE-2026-86091

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260717

Description Insufficient privilege verification in the pools bulk-delete endpoint allows authenticated users without administrator rights to delete all host pools and member bindings. By sending POST requests to the delete pools endpoint, an attacker can irreversibly destroy every host pool, which removes traffic policy bindings and visibility restrictions, potentially bypassing security policies.

Recommendations Update to version 6.7.260717 or later.