What is the CVSS score of CVE-2026-33240?

CVE-2026-33240 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Combodo iTop are affected by CVE-2026-33240?

Combodo iTop (ITSM platform) versions before 3.2.3 contain a reflected cross-site scripting vulnerability in the foreign key search API affecting authenticated users.. A patch is available.

How to fix or mitigate CVE-2026-33240?

Within 24 hours, inventory all Combodo iTop instances and document current versions to identify systems requiring patch 3.2.3. Within 7 days, obtain and validate the 3.2.3 patch in a non-production environment, develop a deployment plan accounting for maintenance windows, and brief relevant teams (IT operations, security, service management) on the update timeline. Within 30 days, deploy patch 3.2.3 to all production iTop instances, verify successful deployment, and confirm users are running the patched version through platform diagnostics.

Combodo iTop CVE-2026-33240

EUVD-2026-64175 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-21 GitHub_M

XSS Itop

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Reflects no attacker auth (PR:N) and mandatory victim interaction (UI:R); availability reduced to L since XSS alone rarely causes service disruption independent of attacker actions.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 21, 2026 - 22:16 vuln.today

Analysis Generated

Aug 21, 2026 - 22:16 vuln.today

Patch available

Aug 21, 2026 - 22:02 EUVD

CVE Published

Aug 21, 2026 - 21:25 cve.org

HIGH 8.8

DescriptionCVE.org

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.

AnalysisAI

Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers to execute arbitrary JavaScript in the browser context of authenticated iTop users by delivering a crafted URL. The CVSS 8.8 rating reflects low attack complexity and high impact on confidentiality, integrity, and availability within the ITSM platform's session context. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The victim must be an authenticated iTop user with an active browser session and must be socially engineered into clicking a crafted URL - the reflected nature of this XSS means no persistent server-side payload is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent for a reflected XSS in a privileged ITSM platform: network-accessible with no attacker authentication required and low exploitation complexity, constrained only by the need for victim interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Combodo iTop 3.2.3 or later, which contains the fix documented in commit 2a16143e53b4019415db90b6ac89f16fc3f773ff (https://github.com/Combodo/iTop/commit/2a16143e53b4019415db90b6ac89f16fc3f773ff) and described in the vendor advisory at https://github.com/Combodo/iTop/security/advisories/GHSA-5hw5-fvw4-55p4. … Detailed patch versions, workarounds, and compensating controls in full report.