Is CVE-2026-27462 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27462 being exploited in the wild.

How severe is CVE-2026-27462?

High severity, with a CVSS score of 7.5, published 21 August 2026.

Is there a fix for CVE-2026-27462?

A patch was published on 2026-02-19: Fixed in versions 3.2.3 and 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27462 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-27462?

Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27462: Combodo iTop user enumeration in password reset

CVE-2026-27462 · Severity: high · CVSS 7.5 · Published 2026-08-21

Combodo iTop is a web-based IT service management platform used to manage IT assets, services, and incidents. The application returns different responses when processing password reset requests for valid versus invalid usernames, allowing attackers to enumerate valid user accounts without authentication. This can be used to compile a list of legitimate usernames for targeted attacks such as brute-force login attempts or phishing campaigns.

Technologies: Combodo iTop. Vendors: Combodo.

Quick answers

Is CVE-2026-27462 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27462 being exploited in the wild.
How severe is CVE-2026-27462?: High severity, with a CVSS score of 7.5, published 21 August 2026.
Which products and versions are affected?: Combodo iTop <3.2.3.
Is there a fix for CVE-2026-27462?: A patch was published on 2026-02-19: Fixed in versions 3.2.3 and 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27462 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-27462?: Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a user enumeration weakness (CWE-204: Observable Response Discrepancy) in iTop's password reset mechanism. The application returns distinguishable responses depending on whether a submitted username exists in the system, allowing an unauthenticated attacker on the network to systematically identify valid accounts. The vulnerability requires no authentication or user interaction and is exploitable via network access. The fix, implemented in version 3.2.3, standardizes password reset error messages so valid and invalid usernames receive identical responses, preventing information disclosure.

Affected products

Combodo iTop <3.2.3

Timeline

2026-08-21: disclosed
2026-02-19: patched: Fixed in versions 3.2.3 and 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.