Combodo iTop CVE-2026-33240

The victim must be an authenticated iTop user with an active browser session and must be socially engineered into clicking a crafted URL - the reflected nature of this XSS means no persistent server-side payload is required. The attacker requires no authentication credentials of their own (PR:N in CVSS). No special non-default server configuration is required; default iTop deployments are vulnerable. Exploitation is practically constrained by the UI:R requirement, making automated mass scanning infeasible and limiting realistic attack vectors to targeted phishing or watering-hole campaigns. iTop instances restricted to internal networks further reduce exposure, though insider phishing remains a residual risk.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent for a reflected XSS in a privileged ITSM platform: network-accessible with no attacker authentication required and low exploitation complexity, constrained only by the need for victim interaction. The high C/I/A ratings are defensible given that iTop manages IT infrastructure records, change requests, and service catalog data - session compromise grants broad operational access. No EPSS score was supplied in the source data, so probability-of-exploitation cannot be quantified numerically; however, the absence of KEV listing and public POC suggests opportunistic exploitation is not yet observed. The UI:R requirement is a meaningful practical constraint, limiting mass exploitation to targeted phishing campaigns rather than automated scanning. Overall this is a genuine remediation priority for any internet-exposed iTop instance, less so for strictly internal deployments behind authenticated network controls.

An attacker crafts a malicious iTop URL embedding an XSS payload in the sTitle or sRemoteClass parameter of the foreign key search API, then delivers it to an authenticated iTop user via phishing email. When the victim clicks the link while logged into iTop, their browser processes the server's reflected response and executes the attacker's script within the iTop session context, enabling session token exfiltration or unauthorized creation and modification of ITSM records. No public proof-of-concept code has been identified.