Combodo iTop CVE-2026-40877

Exploitation requires a valid iTop user account with at minimum low-privilege access (PR:L per CVSS vector), meaning unauthenticated internet-facing attackers cannot directly exploit this vulnerability. The CVSS UI:R metric indicates that some form of user interaction or a multi-step trigger is required beyond simply submitting the malicious preference payload - the precise interaction required is not detailed in the available description but may involve navigating to a page that re-processes stored preferences. The attack is network-accessible (AV:N) against the iTop web interface with low complexity (AC:L) once an authenticated session is established. Exploitation is limited by: the requirement for a valid authenticated session; the UI:R interaction dependency; and the need for PHP classes suitable for POP chain construction to exist in the application's autoloaded scope. Deployments that restrict iTop account creation to vetted internal users and that isolate iTop from shared infrastructure face a meaningfully lower risk profile than internet-exposed instances with open registration.

The CVSS 8.7 base score with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects a high-severity vulnerability with meaningful real-world risk, but several factors moderate the immediate threat level. The PR:L requirement means that only authenticated iTop users - not anonymous internet-facing attackers - can trigger the deserialization. The UI:R component further implies a multi-step or victim-dependent exploitation flow, reducing automatable mass exploitation. Scope:Changed (S:C) is significant: successful exploitation escapes the iTop application context and can impact the underlying operating system, elevating risk for organizations hosting iTop on shared infrastructure. No EPSS data was supplied in the available intelligence, so exploitation probability cannot be quantified. With no KEV listing and no confirmed POC, this is a high-severity, not-yet-exploited-in-the-wild vulnerability - but the PHP object injection class is well-documented and capable attackers with low-privilege iTop accounts could develop working exploits. Priority should be high for internet-exposed iTop deployments; moderate for internal-only deployments with controlled user access.

An attacker with a low-privilege iTop account - such as a disgruntled employee or an attacker who compromised a service desk credential - crafts a malicious PHP serialized object embedding a POP chain targeting classes in iTop's codebase and submits it through the user preferences save functionality. The server-side deserialization triggers the POP chain's magic methods, resulting in arbitrary OS command execution in the context of the web server process. No public exploit code has been identified at time of analysis, but the PHP object injection vulnerability class is well-documented with established POP chain methodologies applicable to PHP frameworks.