diff --git a/SPECS/ntopng/CVE-2026-86090.patch b/SPECS/ntopng/CVE-2026-86090.patch
new file mode 100644
index 00000000000..8ea64e9bbf1
--- /dev/null
+++ b/SPECS/ntopng/CVE-2026-86090.patch
@@ -0,0 +1,67 @@
+From d2c04614887fb8a2ad02dccdbdd0b1c96d323969 Mon Sep 17 00:00:00 2001
+From: Alfredo Cardigliano <cardigliano@ntop.org>
+Date: Thu, 16 Jul 2026 14:42:29 +0200
+Subject: [PATCH] Fix user capability check for deleting notification endpoints
+ and pools
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8.patch
+---
+ scripts/lua/modules/pools/pools_rest_utils.lua | 5 +++++
+ scripts/lua/rest/v2/delete/endpoints.lua       | 6 ++++++
+ scripts/lua/rest/v2/delete/recipients.lua      | 6 ++++++
+ 3 files changed, 17 insertions(+)
+
+diff --git a/scripts/lua/modules/pools/pools_rest_utils.lua b/scripts/lua/modules/pools/pools_rest_utils.lua
+index f0d940a..cc26c84 100644
+--- a/scripts/lua/modules/pools/pools_rest_utils.lua
++++ b/scripts/lua/modules/pools/pools_rest_utils.lua
+@@ -316,6 +316,11 @@ end
+ 
+ -- @brief Get all pools of all the available (currently implemented) pool instances
+ function pools_rest_utils.delete_all_instances_pools()
++   if not auth.has_capability(auth.capabilities.pools) then
++      rest_utils.answer(rest_utils.consts.err.not_granted)
++      return
++   end
++
+    local all_instances = pools_lua_utils.all_pool_instances_factory()
+ 
+    for _, instance in pairs(all_instances) do
+diff --git a/scripts/lua/rest/v2/delete/endpoints.lua b/scripts/lua/rest/v2/delete/endpoints.lua
+index 57e0af1..e570fd5 100644
+--- a/scripts/lua/rest/v2/delete/endpoints.lua
++++ b/scripts/lua/rest/v2/delete/endpoints.lua
+@@ -10,6 +10,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" ..
+ local rest_utils = require "rest_utils"
+ local endpoints = require("endpoints")
+ local recipients = require "recipients"
++local auth = require "auth"
++
++if not auth.has_capability(auth.capabilities.notifications) then
++   rest_utils.answer(rest_utils.consts.err.not_granted)
++   return
++end
+ 
+ endpoints.reset_configs()
+ recipients.cleanup()
+diff --git a/scripts/lua/rest/v2/delete/recipients.lua b/scripts/lua/rest/v2/delete/recipients.lua
+index 392f65f..e7497fc 100644
+--- a/scripts/lua/rest/v2/delete/recipients.lua
++++ b/scripts/lua/rest/v2/delete/recipients.lua
+@@ -8,6 +8,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" ..
+ 
+ local rest_utils = require "rest_utils"
+ local recipients = require "recipients"
++local auth = require "auth"
++
++if not auth.has_capability(auth.capabilities.notifications) then
++   rest_utils.answer(rest_utils.consts.err.not_granted)
++   return
++end
+ 
+ recipients.cleanup()
+ rest_utils.answer(rest_utils.consts.success.ok)
+-- 
+2.45.4
+
diff --git a/SPECS/ntopng/ntopng.spec b/SPECS/ntopng/ntopng.spec
index 533a67f89d9..3c95f35f1d5 100644
--- a/SPECS/ntopng/ntopng.spec
+++ b/SPECS/ntopng/ntopng.spec
@@ -2,7 +2,7 @@
 Summary:        Web-based Network Traffic Monitoring Application
 Name:           ntopng
 Version:        5.2.1
-Release:        6%{?dist}
+Release:        7%{?dist}
 License:        GPLv3
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -19,6 +19,7 @@ Patch4:         CVE-2022-33099.patch
 Patch5:         CVE-2021-44647.patch
 Patch6:         CVE-2021-43519.patch
 Patch7:         CVE-2021-44964.patch
+Patch8:         CVE-2026-86090.patch
 BuildRequires:  curl-devel
 BuildRequires:  gcc
 BuildRequires:  glib-devel
@@ -68,6 +69,9 @@ mv nDPI-%{nDPIver} nDPI
 %{_datadir}/ntopng/*
 
 %changelog
+* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 5.2.1-7
+- Patch for CVE-2026-86090
+
 * Fri Dec 26 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 5.2.1-6
 - Patch to fix CVE-2021-44964