What is CVE-2026-40877?

CVE-2026-40877 is a high-severity vulnerability in Combodo Itop, classified under Code Injection. CVSS score: 8.7/10. Published 2026-08-24.

How severe is CVE-2026-40877?

High severity. CVSS v3 base score is 8.7 out of 10.

RCE in Combodo Itop

CVE-2026-40877

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.

Affected products

Combodo Itop — versions < 3.2.3

Weakness classification (CWE)

CWE-94 — Code Injection
CWE-502 — Deserialization of Untrusted Data

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-40877?: CVE-2026-40877 is a high-severity vulnerability in Combodo Itop, classified under Code Injection. CVSS score: 8.7/10. Published 2026-08-24.
How severe is CVE-2026-40877?: High severity. CVSS v3 base score is 8.7 out of 10.