CVE-2026-39975 Combodo CVE debrief

Who should care

Defenders responsible for iTop instances, especially those with unauthenticated access, should assess exposure and apply remediation. This includes verifying instance versions, assessing and applying remediation for affected versions, and monitoring for potential exploitation attempts. Additionally, defenders should review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and retest remediated assets.

Why it matters

CVE-2026-39975 is a critical vulnerability in Combodo iTop that allows unauthenticated users to delete the .readonly file, potentially leading to code execution. Defenders should prioritize verifying exposure and remediation for iTop instances, especially those with unauthenticated access. Evidence is limited, and details on exploitation and impact require verification from official sources.

• Potential code execution risk requires verification and remediation priority
• Unauthenticated access to iTop instances may allow exploitation
• Deletion of .readonly file could lead to write actions and increased risk

Technical summary

CVE-2026-39975 is a critical vulnerability in Combodo iTop, allowing unauthenticated users to delete the .readonly file, potentially leading to code execution. The issue is fixed in version 3.2.3. This vulnerability affects iTop instances, especially those with unauthenticated access. Defenders should prioritize verifying exposure and remediation for iTop instances. Evidence from the CVE Program and NVD indicates that unauthenticated users could delete the .readonly file, potentially leading to code execution. However, details on exploitation and impact are limited.

Defensive priority

Defenders should prioritize verifying exposure and remediation for iTop instances, especially those with unauthenticated access.

Recommended defensive actions

• Verify iTop instance versions and exposure
• Assess and apply remediation for affected versions
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the CVE Program and NVD indicates that unauthenticated users could delete the .readonly file, potentially leading to code execution. However, details on exploitation and impact are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.