Quick answers
- Is CVE-2026-39975 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39975 being exploited in the wild.
- How severe is CVE-2026-39975?
- Informational severity, with a CVSS score of 9.4, published 24 August 2026.
- Which products and versions are affected?
- Combodo iTop prior to 3.2.3.
- Is there a fix for CVE-2026-39975?
- A patch was published on 2026-08-24: NVD entry published; fix available in versions 3.2.3 and 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-39975 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-39975?
- Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an unsafe eval vulnerability in the ext_auth_variable configuration parameter. When processing external authentication settings, iTop fails to properly validate or sanitize the ext_auth_variable value before passing it to eval(), allowing arbitrary PHP code execution. The attack requires high-level privileges (administrative access) and network connectivity to the iTop instance. An attacker with config editor access can inject malicious code that will be executed with the privileges of the web server process, leading to complete system compromise. The issue is fixed in iTop versions 3.2.3 and 3.3.0 by implementing whitelisting of allowed ext_auth_variable values.
Affected products
- Combodo iTop prior to 3.2.3
Timeline
- 2026-08-10: disclosed: GitHub advisory published
- 2026-08-24: patched: NVD entry published; fix available in versions 3.2.3 and 3.3.0