CVE-2026-86090 ntop CVE debrief

Who should care

Defenders responsible for monitoring and maintaining ntopng installations should be aware of this vulnerability and take steps to verify the version in use and assess potential impact.

Why it matters

CVE-2026-86090 is a high-severity vulnerability in ntopng that allows authenticated non-administrator users to delete notification endpoints and recipients, effectively silencing all alerts. Defenders should prioritize verifying the version of ntopng in use and assessing the potential impact on their systems.

• Authenticated non-administrator users can delete notification endpoints and recipients
• Deletion of notification endpoints and recipients can silence all alerts
• Verification of ntopng version and access controls is necessary
• Remediation priority is high due to potential impact on alerting capabilities

Technical summary

The vulnerability is caused by a lack of authorization checks in the delete endpoints and recipients REST v2 handlers in ntopng. This allows authenticated non-administrator users to issue POST requests to irreversibly delete all configured notification endpoints and recipients, effectively silencing all alerts. The issue affects ntopng versions prior to 6.7.260717 and can be mitigated by verifying the version in use and assessing potential impact on systems. Defenders should prioritize verifying the version of ntopng in use and assessing the potential impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying the version of ntopng in use and assessing the potential impact of this vulnerability on their systems.

Recommended defensive actions

• Verify the version of ntopng in use and assess potential impact
• Review and update access controls for notification endpoints and recipients
• Monitor for any suspicious activity related to notification endpoint and recipient deletion
• Apply vendor patches or updates to address the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact versions of ntopng that are affected or fixed are not specified in the provided corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.