A network monitoring login should not become an operating-system shell. The ntopng vulnerability-scan feature creates exactly that trust-boundary risk on affected deployments.
What is new — November 7, 2026: MSRC added CVE-2026-82413 at 01:01:27 UTC and names azl3 ntopng 5.2.1-7 on Azure Linux 3.0. The CNA record was published November 5; the upstream GHSA-9xj6-f266-r46p page dates its original publication July 16. This alert concerns the new Microsoft package applicability, not a claim that the upstream issue was first disclosed today. Last verified: November 7, 2026 UTC.
Applicability and priority
The current upstream advisory header lists affected ntopng 6.7.260716 and earlier and patched 6.7.260717 and later; the CNA says versions below 6.7.260717 are affected. Any authenticated session, including a non-administrator, can supply the vulnerability scan’s scan_ports input. If login is disabled, the same request can be unauthenticated. Command execution requires nmap to be installed; the tcp_portscan and cve modules additionally require an initial probe to report the target up. Commands run as the ntopng service account.
Vendor facts: Microsoft rates the issue Important; the upstream advisory labels it High. Both publish CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Suggested MSP priority: prioritize reachable ntopng management interfaces with scan capability, especially shared-user or login-disabled installations. Inventory actual products and configurations before assigning remediation.
Fixes, limits and exploitation status
The CNA and current upstream header identify 6.7.260717 as fixed. The advisory body retains older draft language saying no patch and describing 6.6/dev; that conflicts with its current header. Use the current header and CNA for the upstream fix, and validate the supported package build with its distributor. Microsoft’s row has an empty FixedBuild, no specific KB/RPM download, and generic Azure Linux update guidance. A fixed Azure Linux RPM or AKS image is not verified here; do not treat the upstream build as an interchangeable Microsoft package.
As suggested containment, limit access to trusted administrators and disable or restrict the affected scan feature/endpoints while arranging a supported update. Authentication alone is insufficient because non-admin sessions are affected. These access controls reduce exposure; they do not repair the input handling.
CVE-2026-82413 is absent from CISA’s current full KEV catalog. The upstream advisory contains a laboratory proof-of-concept; that is not evidence of attacks in the wild. The reviewed official material does not confirm active exploitation, and no KEV federal deadline applies. No vendor-directed integrity scan or mandatory credential rotation is specified.
What I would do across customer environments
- Inventory ntopng versions, Azure Linux packages and bundled containers. Check management reachability, enabled authentication, user roles, nmap installation and active-scan use.
- Contain confirmed exposure by restricting management access and the affected scan functions. If logs or process activity suggest compromise, investigate the host rather than assuming an upgrade removes an intrusion.
- Roll out the supported distributor fix or a supported upstream release at or above 6.7.260717 after testing. Track Microsoft package availability separately.
- Verify the running binary/package provenance, management controls and scan permissions, then review unexpected scheduled scans and child-shell activity. Record evidence for each applicable customer environment.
Official sources: Microsoft November CVRF data; MSRC CVE-2026-82413; ntop’s GHSA-9xj6-f266-r46p; official CNA record; Microsoft Azure Linux upgrade guidance; CISA KEV data.