CVE-2026-38968: Critical severity ntopng ntopng vulnerability
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38968?
The severity of CVE-2026-38968 is critical with a score of 9.8.
How do I fix CVE-2026-38968?
To fix CVE-2026-38968, update to ntopng version 6.7 or later, where the vulnerability is addressed.
What does CVE-2026-38968 expose users to?
CVE-2026-38968 exposes users to the risk of session hijacking due to predictable session identifiers.
Which versions of ntopng are affected by CVE-2026-38968?
ntopng versions up to and including 6.6 are affected by CVE-2026-38968.
What type of vulnerability is CVE-2026-38968?
CVE-2026-38968 is a vulnerability related to predictable session identifiers leading to session hijacking.