Combodo iTop CVE-2026-27463

No special conditions are required beyond network access to the iTop login page - CVSS AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation with low complexity against default configurations of Combodo iTop prior to 3.2.3. The login page is the attack surface; any instance reachable via HTTP/HTTPS is vulnerable. Exploitation is strictly limited to retrieval of the version string (confidentiality: low); no direct code execution, authentication bypass, or data access is possible through this flaw alone. The primary limiting factor is impact scope: this vulnerability is only operationally significant as a chaining step, providing version targeting intelligence to facilitate follow-on attacks against unpatched instances.

The CVSS 5.3 Medium score and vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately represents a remotely exploitable, zero-complexity, unauthenticated information disclosure with bounded impact limited to version string retrieval. This is a reconnaissance primitive, not a direct exploitation vector. No KEV listing and no identified POC suggest this has not been actively weaponized. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified. The realistic risk is low for organizations with current patch cycles; elevated risk exists for internet-facing iTop deployments on outdated versions, where version disclosure enables an attacker to correlate the exposed version against known CVEs and construct targeted follow-on attacks. There are no conflicting signals between the CVSS vector and the description - the local HTML source inspection model is consistent with a network-accessible login page.

An unauthenticated attacker sends an HTTP GET request to the target iTop login URL and inspects the HTML page source, extracting the exact iTop version from the logo element's title attribute without any credentials or special tooling. The attacker then queries public vulnerability databases for CVEs specific to that iTop version and proceeds with targeted exploitation of any identified vulnerabilities. No public POC exists for this specific disclosure, and no exploit automation has been identified.