PT-2026-79494
CVE-2026-34741
·
Published
2026-08-21
·
Updated
2026-10-12
Description by
CVSS 3.1
8.6
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Name of the Vulnerable Software and Affected Versions
Combodo iTop versions prior to 3.2.3
Description
Combodo iTop is a web-based IT service management tool. An authentication bypass exists that allows unauthenticated remote attackers to execute arbitrary PHP files from the
env-production directory on new instances configured for a production environment. This is achieved through the exec.php endpoint.Recommendations
Update to version 3.2.3.
Found an issue in the description? Have something to add? Feel free to write us 👾