CVE-2026-27462 Combodo iTop: User enumeration via password reset
Attackers can enumerate valid usernames via inconsistent password reset responses in Combodo iTop, facilitating targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27462?
CVE-2026-27462 is a high-severity vulnerability in Combodo iTop, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.
Weakness: CWE-204
Which versions are affected by CVE-2026-27462?
How do I fix CVE-2026-27462?
No fix has been published for CVE-2026-27462 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27462 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27462 exists.
Sources
Also known as GHSA-888g-gv33-xwwx.