CVE-2026-39975

Executive Summary

CVE-2026-39975 is a critical authentication bypass and arbitrary code execution vulnerability affecting Combodo iTop, a web-based IT service management (ITSM) platform, in versions prior to 3.2.3. The vulnerability allows unauthenticated remote attackers to delete the .readonly file on iTop instances — a marker file created during the setup process that prevents unauthenticated write operations. Successful exploitation grants an attacker the ability to perform write actions on the application, ultimately leading to remote code execution. Given the network-accessible nature of iTop deployments and the low complexity of exploitation, this vulnerability poses a severe risk to organizations running unpatched versions, potentially enabling full compromise of the underlying server.

Technical Analysis

The NVD description indicates that Combodo iTop versions prior to 3.2.3 contain a flaw that permits unauthenticated users to delete the .readonly file on an iTom instance. This file is a sentinel created during the installation/setup process, acting as a lock that prevents write operations (e.g., configuration changes, data modification) until the administrator has completed the installation and explicitly removed the file. By deleting this file without authentication, an attacker can bypass the intended write-protection gate, effectively transitioning the application from a read-only to a read-write state.

The vulnerability class is CWE-94: Improper Control of Generation of Code ('Code Injection' / 'Remote Code Execution'). However, the immediate mechanism is an Insecure Direct Object Reference (IDOR) / Missing Authentication for Sensitive Operation — the ability to trigger a file-deletion operation on a server-side resource without valid credentials. The attack surface is the web-facing iTop application, which exposes file-management or setup functionality that does not verify the caller's identity before performing the deletion.

The code-level mechanism, based on the description, can be summarized as follows:

1. The .readonly file is created in the iTop installation directory during the setup wizard.
2. Some endpoint or API call within the application allows deletion of this file — possibly the installation/setup controller, which may fail to enforce an authentication check when the file exists.
3. Because the file is deleted pre-authentication, the application subsequently allows write operations to arbitrary users, including the attacker.
4. Write access, in the context of an ITSM tool like iTop, typically includes the ability to modify application files, templates, or data — which can be leveraged to inject malicious code (PHP, in the case of a PHP-based application) that executes on the server.

Note: The NVD description does not specify the exact URI, function name, or request structure required to trigger the deletion. Insufficient technical detail is available to map the precise code path. The attack mechanism is inferred from the described behavior: an unauthenticated file-deletion primitive leading to write-access escalation and code execution.

Exploitation Scenarios

The attack chain for CVE-2026-39975, based on the available data, is as follows:

Step 1: Reconnaissance / Target Identification An attacker scans for exposed iTop instances using search engines or internet-wide scanners. Identifiable by the application's default login page, branding strings such as "iTop," or specific HTTP response headers. Shodan queries such as title:"iTop" or http.title:"iTop" can locate targets. The attacker then verifies the version is below 3.2.3 (e.g., via version disclosure in the login page footer or release files).

Step 2: Triggering the File-Deletion Flaw The attacker sends a crafted HTTP request to a vulnerable iTop instance attempting to delete the .readonly file. While the exact endpoint is not disclosed in the NVD description, plausible targets include setup-related URLs or an API method that handles file operations without prior authentication. The request requires no session cookie, no Basic Auth credentials, and no CSRF token — it is fully unauthenticated.

Step 3: Payload / Execution Method After the .readonly file is deleted, the application permits write operations. The attacker — still unauthenticated — can now exploit this escalated state. Write access in iTop typically allows modification of:

• Application configuration files (e.g., configuration settings, database connection strings).
• Template files (used for rendering UI).
• Data objects (e.g., creating or altering ITSM records).

The attacker can leverage this write primitive to achieve code execution. For example, if the application allows uploading or modifying PHP templates or modules, the attacker can inject a malicious PHP payload and trigger its execution by requesting the modified file. Alternatively, the attacker might modify a configuration file to point to an attacker-controlled database and inject malicious data that gets eval'd or included at runtime. The end result is arbitrary server-side code execution under the privileges of the web server user.

Step 4: Post-Exploitation Impact Once code execution is achieved, the attacker gains a foothold on the server. Potential post-exploitation actions include:

• Establishing a persistent reverse shell or web shell.
• Reading sensitive ITSM data (configuration items, tickets, credentials stored in the DB).
• Lateral movement within the internal network, as iTop often holds privileged credentials and service accounts.
• Pivoting to other internal systems via the compromised server.

Current Exploitation Status: No public PoC is available, and no Nuclei template or exploit code has been observed. The attack chain described above is inferred from the vulnerability class and the NVD description. It is likely that technical details will emerge once researchers analyze the fix in version 3.2.3.

Impact Assessment

Business Impact: Combodo iTop is a widely deployed open-source ITSM platform used for change management, incident management, and configuration management (CMDB). A successful exploit provides unauthenticated remote code execution, which:

• Removes the confidentiality, integrity, and availability of the iTop application and its underlying OS.
• Exposes sensitive ITSM data — including infrastructure details, service credentials, and organizational change records — which is valuable for targeted attacks.
• Enables lateral movement: iTop instances are typically hosted on internal networks with access to other systems, and often store service account credentials for integrations.

Affected Systems: All Combodo iTop instances running versions prior to 3.2.3 and exposed to untrusted networks. Instances hidden behind VPNs remain at risk if network segmentation is incomplete or if attackers have already breached the perimeter.

Blast Radius:

• Confidentiality: Complete loss — attacker can read all data and files accessible to the web server user.
• Integrity: Complete loss — attacker can modify, delete, or inject application files and data.
• Availability: Complete loss — attacker can cause denial of service, deface the portal, or pivot to disrupt dependent systems.

CVSS Context: CVSS is N/A for this CVE, but based on the described impact (unauthenticated RCE), the score would likely be in the 9.0–10.0 range under CVSS v3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The absence of an official score is a gap that organizations should compensate for by treating this as a critical issue.

Detection Guidance

Note: The following rules are generated based on the vulnerability behavior (unauthenticated file deletion and subsequent abnormal write activity on iTop instances). They may need tuning based on the specific environment.

Sigma Rule

The Sigma rule detects HTTP requests targeting setup or file-management endpoints on iTop, which is the likely trigger for the vulnerability.

title: Combodo iTop Unauthenticated .readonly File Deletion Attempt
id: c4f8e1a2-3b5d-4c6e-9f1a-2b3c4d5e6f7a
status: experimental
description: Detects unauthenticated HTTP requests targeting iTop endpoints that may delete the .readonly file, leading to RCE (CVE-2026-39975).
author: ValtersIT Threat Intelligence
logsource:
  category: webserver
  product: apache
  detection:
    selection:
      cs-method: 
        - 'GET'
        - 'POST'
      c-uri|contains:
        - '/setup/'
        - '/install/'
        - '/pages/'
        - '.readonly'
        - 'readonly'
    filter_local:
      c-uri|contains:
        - '/setup/index.php'
        - 'authenticated=true'
    condition: selection and not filter_local
  level: high
  tags:
    - attack.t1190
    - attack.t1210
    - cve.2026.39975
    - cwe.94

YARA Rule

YARA rule for scanning logs or captured HTTP payloads for exploit strings in the iTop setup flow.

rule Combodo_iTop_Readonly_Delete_Exploit {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects attempts to delete the .readonly file on Combodo iTop instances (CVE-2026-39975)"
        cve = "CVE-2026-39975"
        date = "2026-05-15"
    strings:
        $a = ".readonly" ascii wide
        $b = "setup" ascii wide
        $c = "delete" ascii wide
        $d = "install" ascii wide
        $e = "iTop" ascii wide
    condition:
        uint16(0) == 0x0D0A and any of them and 2 of ($a,$b,$c,$d,$e)
}

Suricata IDS Rule

Suricata rule to alert on unauthenticated requests to iTop setup/file-management endpoints from external hosts.

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Combodo iTop .readonly File Deletion Attempt (CVE-2026-39975)";
    flow:established,to_server;
    content:".readonly"; http_uri;
    nocase;
    content:"setup"; http_uri;
    nocase;
    classtype:attempted-admin;
    sid:2026039975;
    rev:1;
    metadata:created_at 2026_05_15, cve CVE-2026-39975;
)

Elastic Detection

EQL rule for detecting web access log patterns indicative of the exploit attempt.

sequence by host.name, source.ip
  [ network where process.name == "httpd" and destination.port == 443 and
    url.path in ("/setup/*", "/install/*", "/pages/*") and 
    url.path like "*readonly*" ]
  [ file where process.name == "httpd" and file.name == ".readonly" and
    file.action == "delete" ]

Splunk SPL Query

Splunk query to detect repeated setup/install page requests from unique IPs (potential scanning) or the specific deletion attempt.

index=web sourcetype=access_combined
| where like(uri, "%readonly%") OR like(uri, "%setup%") OR like(uri, "%install%")
| eval event_type = case(
      like(uri, "%readonly%"), "readonly_deletion_attempt",
      like(uri, "%setup%"), "setup_endpoint_access",
      like(uri, "%install%"), "install_endpoint_access"
  )
| stats count by src_ip, event_type, uri, status
| where count > 5 OR event_type == "readonly_deletion_attempt"
| sort - count
| table _time, src_ip, uri, status, event_type, count

Wazuh OSSEC Rule

Wazuh decoders and rule for detecting the exploit attempt in web server logs.

<group name="web,combodo,itop,">
    <rule id="100100" level="12">
        <decoded_as>web</decoded_as>
        <match>readonly</match>
        <regex>\.readonly</regex>
        <description>Combodo iTop .readonly file deletion attempt detected (CVE-2026-39975)</description>
        <group>cve-2026-39975,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED.
No patch evidence is available from tracked sources (vendor advisory, GitHub releases, or security bulletins). The NVD description states the issue is "fixed in version 3.2.3," but no official advisory or patch-specific documentation has been published at the time of this report.

Immediate Mitigations (do all of the following NOW):

1. Restrict network access: Place iTom instances behind a VPN or firewall, allowing only trusted IP ranges to reach the web interface. If the instance must be internet-facing, use an application-layer firewall (WAF) with custom rules to block requests containing .readonly or targeting setup/install endpoints.
2. Review current authentication state: Immediately inspect the iTop deployment to confirm whether the .readonly file is present. If it is missing, assume the instance may already be compromised and conduct a forensic review.
3. Disable setup/install functionality: If possible, remove or restrict access to setup-related scripts and directories (e.g., /setup/) using web server configuration (e.g., deny all requests).
4. Monitor for anomalous write activity: Enable file integrity monitoring (e.g., OSSEC, Tripwire) on the iTop installation directory, especially for .readonly and PHP template files.

Patch/Upgrade Steps:

1. Since the vendor has not yet released an official advisory, monitor the Combodo security page (https://www.combodo.com/security) and the GitHub repository (https://github.com/Combodo/iTop) for a 3.2.3 release announcement.
2. Once available, upgrade all iTop instances to version 3.2.3 or later. Follow the official upgrade procedure: back up the database and files, then run the upgrade script.
3. Verify the .readonly file is recreated and present after the upgrade.

Long-Term Hardening:

1. Network segmentation: Isolate iTop instances in a demilitarized zone (DMZ) separate from core production networks.
2. Harden the web server: Run iTop under a non-privileged OS user with minimal filesystem write permissions outside the web root. Disable PHP functions such as exec, shell_exec, and system via disable_functions in php.ini.
3. Regular patch cadence: Subscribe to vendor security advisories and apply updates for iTop and its dependencies (PHP, MySQL) on a 30-day cycle.
4. Log retention and review: Enable centralized logging and retain web access logs for at least 90 days to enable post-incident analysis.
5. Deploy a WAF: Use ModSecurity or a commercial WAF to enforce positive security models on the iTop website, blocking setup URIs and file-deletion patterns.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-39975 — Official CVE metadata and description (accessed 2026-05-15).
2. Combodo Security Advisories: https://www.combodo.com/security — Vendor security page (pending advisory for 3.2.3).
3. Combodo iTop GitHub Repository: https://github.com/Combodo/iTop — Source code and release announcements (check for 3.2.3 tag).
4. MITRE ATT&CK — T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — Common technique mapping for this vulnerability.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-39975 is NOT listed as of this report's date; monitor for updates.

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for CVE-2026-39975 at the time of writing. However, given the criticality (unauthenticated RCE) and the widespread deployment of iTop, exploitation attempts are expected to emerge shortly after technical details become public. Organizations should treat this as an active threat and prioritize mitigation.