CVE-2026-38968

9.8 criticalEPSS 0.6%

Critical (9.8) in ntop ntopng. EPSS 0.6% chance of exploitation in the next 30 days.

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-341
Published: 2026-07-02
Modified: 2026-07-08
Record from: the NVD, synced 2026-10-19

Affected

ntop:ntopng

References

https://github.com/ntop/ntopng/commit/14e22497233dc7d31d19dccb74b13bb073d16c2c
https://github.com/ntop/ntopng/commit/179a346ceb6239fd36128ccca3efa8f9ea61eeb5

Check your stack JSON