Combodo iTop CVE-2026-39975

The instance must be running Combodo iTop prior to 3.2.3 and be network-reachable by the attacker, with the setup-created .readonly lockfile present and its deletion endpoint accessible. Per the description the deletion is performed by unauthenticated users, so the limiting factors are essentially reachability of the instance and the version being below 3.2.3 - not credentials or user interaction. NOTE the discrepancy: the provided CVSS 4.0 vector encodes PR:H (authentication required), which conflicts with the description's 'unauthenticated users'; if the vendor confirms PR:H, exploitation would additionally require an authenticated/high-privilege session, so confirm the true privilege prerequisite against GHSA-h823-537c-xwfh before de-prioritizing.

Signals are strong but partly conflicting and must be read carefully. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, all impacts High, plus subsequent-system High) yields 9.4, yet it encodes PR:H (privileges required) which directly contradicts the description's explicit 'unauthenticated users' - verify with the vendor advisory, as the true attack likely needs no authentication (PR:N), which would make real-world risk higher than the metrics' privilege assumption implies. Attack vector is network with low complexity and no user interaction, so exploitation is technically easy once the endpoint is known. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so this is not confirmed as actively exploited; however, the combination of unauthenticated network reach, low complexity, and full RCE impact makes this a genuine high priority rather than an inflated-CVSS/low-real-risk case. Treat as high priority for any externally exposed iTop instance.

An attacker who can reach an internet-exposed iTop instance below 3.2.3 sends a crafted unauthenticated request that deletes the .readonly sentinel file, unlocking the application's write/setup-capable state. From that state the attacker abuses the re-enabled configuration/setup functionality to inject and execute arbitrary PHP code on the server. No public POC is referenced, but the single-request, no-authentication, no-interaction nature makes reliable exploitation straightforward.