Combodo iTop EUVD-2026-64189

No special conditions are required beyond network reachability of the iTop web interface - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is a remote, unauthenticated, low-complexity attack against default iTop deployments that have completed the setup process (which creates the .readonly file). The .readonly file must exist on the target instance, meaning setups that have not yet reached that stage would not be affected. Exploitation is limited by network exposure: iTop instances behind internal firewalls or VPNs require network-level access first. No specific feature flag or non-default configuration is required - any fully set up iTop instance prior to 3.2.3 is vulnerable by default.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L captures the network-accessible, zero-friction nature of this attack, but the I:L/A:L ratings may understate the downstream consequence: removing write protection unlocks the ability to perform configuration and data modifications that the protection was explicitly designed to block, potentially serving as a prerequisite for further compromise. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation at time of analysis. There is no publicly referenced POC code, though the simplicity of the attack - a single unauthenticated HTTP request - means the bar to exploitation is negligible for any attacker with network access. The primary limiting factor is exposure: iTop instances not directly accessible from the internet significantly reduce real-world risk.

An unauthenticated external attacker discovers a publicly accessible iTop instance and sends a single crafted HTTP request to the vulnerable endpoint that triggers deletion of the .readonly file. With write protection removed, the attacker - or a subsequent actor - can then perform write operations on the iTop instance that were previously blocked, such as altering ITSM configuration, creating admin accounts, or modifying service records. No POC has been publicly identified, but the trivial attack complexity means functional exploitation requires minimal skill.