Is CVE-2026-86090 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86090?

CVE-2026-86090 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-86090

Description

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.