CVE-2026-38968

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session...

9.8 CriticalFix available

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.55%Up 0.4 points since Jul 3, 2026

What each source reports

CVE List Score used 9.8

Record: CVE-2026-38968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-341
Updated: 2026-11-02

EUVDEUVD-2026-41472 9.8

Record: EUVD-2026-41472
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5rrm-76q9-hp77 9.8

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session...

Record: GHSA-5rrm-76q9-hp77
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-341
Updated: 2026-11-02

NVD 9.8

Record: CVE-2026-38968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-341
Updated: 2026-11-02

OSV 9.8

Record: CVE-2026-38968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-38968 9.8

Record: UBUNTU-CVE-2026-38968
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-92103 No score

CVE-2026-38968 affecting package ntopng for versions less than 5.2.1-7

Record: AZL-92103
Updated: 2026-11-05

Affected products

ntop ntopng

Affected packages

Affected packages
Package	Affected	Fixed
`ntopng` Azure Linux:3	before 5.2.1-7	5.2.1-7
`ntopng` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.2.1+dfsg1-2ubuntu12.0+dfsg1-12.2+dfsg1-12.2+dfsg1-1build12.2+dfsg1-1ubuntu0.1~esm2	None known
`ntopng` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.4+dfsg1-32.4+dfsg1-43.2+dfsg1-13.2+dfsg1-1ubuntu0.1~esm2	None known
`ntopng` Ubuntu:20.04:LTS	All versions, plus listed versions 3.8+dfsg1-2.1build3	None known
`ntopng` Ubuntu:22.04:LTS	All versions, plus listed versions 5.2.1+dfsg1-1	None known
`ntopng` Ubuntu:24.04:LTS	All versions, plus listed versions 5.2.1+dfsg1-15.2.1+dfsg1-1ubuntu15.2.1+dfsg1-1ubuntu35.2.1+dfsg1-1ubuntu4	None known
`ntopng` Ubuntu:25.10	All versions, plus listed versions 5.2.1+dfsg1-2ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-38968 is a critical vulnerability (CVSS 9.8) in Ntop Ntopng, published July 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in ntopng 5.2.1-7.