CVE-2026-34741 HIGH

CVE-2026-34741: Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Vendor Combodo
Product iTop
Weakness CWE-306 · Missing auth
Published August 21, 2026
Last update August 21, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

Key dates

02Disclosure timeline

August 21, 2026 CVE published