Which versions of Combodo iTop are affected by CVE-2026-39975?

Combodo iTop versions before 3.2.3 are vulnerable to unauthenticated remote code execution, allowing attackers to bypass all authentication and security controls through a trivial file-deletion…. A patch is available.

How to fix or mitigate CVE-2026-39975?

Within 24 hours: Identify and inventory all iTop instances in the organization and determine their network exposure (internet-facing vs. internal-only); immediately restrict all external access to iTop administrative and setup endpoints via firewall rules, VPN-gating, or air-gapping until mitigation is in place. Within 7 days: Apply interim controls by making the .readonly lockfile immutable at the filesystem level (chattr +i); implement strict file-permission restrictions on setup directories; deploy WAF rules to block or alert on any DELETE or write requests to setup paths; enable comprehensive request logging for all setup-path access. Within 30 days: Monitor Combodo's security advisories continuously; prepare a full upgrade plan to iTop 3.2.3 or later; apply the vendor patch immediately upon release and test in staging before production rollout.

Combodo iTop CVE-2026-39975

Q: What is the CVSS score of CVE-2026-39975?

CVE-2026-39975 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-65073 CRITICAL

Code Injection (CWE-94)

2026-08-24 GitHub_M

Code Injection RCE Itop

9.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Description states unauthenticated network deletion with no interaction leading to RCE, so AV:N/AC:L/PR:N/UI:N with full C/I/A; contradicts input vector's PR:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 24, 2026 - 20:01 EUVD

Analysis Generated

Aug 24, 2026 - 19:39 vuln.today

CVE Published

Aug 24, 2026 - 18:50 cve.org

CRITICAL 9.4

DescriptionCVE.org

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

AnalysisAI

Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .readonly lockfile, which is the guard that blocks write operations and, once removed, re-opens privileged setup/configuration paths that lead to arbitrary code execution (CWE-94). Any internet-reachable iTop instance below 3.2.3 is affected, and the flaw carries a CVSS 4.0 score of 9.4 with full confidentiality, integrity and availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The instance must be running Combodo iTop prior to 3.2.3 and be network-reachable by the attacker, with the setup-created .readonly lockfile present and its deletion endpoint accessible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are strong but partly conflicting and must be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Combodo iTop 3.2.3 or later, which corrects the handling of the .readonly setup lockfile; this is the primary and recommended fix per advisory GHSA-h823-537c-xwfh (https://github.com/Combodo/iTop/security/advisories/GHSA-h823-537c-xwfh). … Detailed patch versions, workarounds, and compensating controls in full report.