CVE-2026-40877CWE-502CWE-94insecure-deserializationcode-injection

CVE-2026-40877

High · published August 24, 2026

CVSS v3.1
8.7
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00533 · 44.2th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-24T23:16Z
References (1)
https://github.com/Combodo/iTop/security/advisories/GHSA-3mq5-p5vh-cw7r · [email protected]
EPSS history
Timeline
  • 26 AUG 08:02Z
    EPSS moved — → 0%
    epss
  • 24 AUG 18:57Z
    Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences
    cvelistv5