# CVE-2026-39975: Combodo iTop remote code execution via unsafe eval

Source: https://junglewise.ai/threats/cve-2026-39975-combodo-itop-remote-code-execution-via-unsafe-eval  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-39975 · Severity: info · CVSS 9.4 · Published 2026-08-24

Combodo iTop is a web-based IT service management platform used by organizations to track and manage IT infrastructure and services. A vulnerability in iTop's external authentication variable handling allows privileged users to execute arbitrary code on the server through unsafe use of PHP's eval() function. An attacker with administrative or configuration-editing privileges could exploit this to gain complete control over the iTop instance and potentially the underlying infrastructure.

Technologies: [Combodo iTop](https://junglewise.ai/threats/technologies/itop). Vendors: [Combodo](https://junglewise.ai/threats/vendors/combodo).

## Quick answers

**Is CVE-2026-39975 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39975 being exploited in the wild.

**How severe is CVE-2026-39975?** Informational severity, with a CVSS score of 9.4, published 24 August 2026.

**Which products and versions are affected?** Combodo iTop prior to 3.2.3.

**Is there a fix for CVE-2026-39975?** A patch was published on 2026-08-24: NVD entry published; fix available in versions 3.2.3 and 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39975 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39975?** Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unsafe eval vulnerability in the ext_auth_variable configuration parameter. When processing external authentication settings, iTop fails to properly validate or sanitize the ext_auth_variable value before passing it to eval(), allowing arbitrary PHP code execution. The attack requires high-level privileges (administrative access) and network connectivity to the iTop instance. An attacker with config editor access can inject malicious code that will be executed with the privileges of the web server process, leading to complete system compromise. The issue is fixed in iTop versions 3.2.3 and 3.3.0 by implementing whitelisting of allowed ext_auth_variable values.

## Affected products

- Combodo iTop prior to 3.2.3

## Timeline

- 2026-08-10: disclosed: GitHub advisory published
- 2026-08-24: patched: NVD entry published; fix available in versions 3.2.3 and 3.3.0

## References

- [https://github.com/Combodo/iTop/security/advisories/GHSA-h823-537c-xwfh](https://github.com/Combodo/iTop/security/advisories/GHSA-h823-537c-xwfh)

## Related threats

- [Combodo iTop missing authorization in LinkSetController](https://junglewise.ai/threats/cve-2026-108717-combodo-itop-3-1-0-through-3-3-0-contains-a-missing)
- [Combodo iTop PHP object injection in user preferences](https://junglewise.ai/threats/cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences)
- [Combodo iTop reflected XSS in dashboard revert](https://junglewise.ai/threats/cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert)
- [Combodo iTop .readonly file deletion by unauthenticated users](https://junglewise.ai/threats/cve-2026-34949-combodo-itop-readonly-file-deletion-by-unauthenticated-users)
- [Combodo iTop access control bypass in OQL joins](https://junglewise.ai/threats/cve-2026-34948-combodo-itop-access-control-bypass-in-oql-joins)