Refine your search

9 vulnerabilities found for BMC IT Service Management Suite by BMC

CVE-2026-113696 (GCVE-0-2026-113696)
Vulnerability from cvelistv5
Published
2026-10-29 13:29
Modified
2026-10-29 13:49
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
Summary
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113696",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:49:45.547508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T13:49:59.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT change approval feature"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.\u003c/p\u003e"
            }
          ],
          "value": "Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can perform the attack remotely without additional user interaction."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:29:15.025Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113696",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Improper Authorization in BMC ITSM SmartIT Change Approvals",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113696",
    "datePublished": "2026-10-29T13:29:15.025Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T13:49:59.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113695 (GCVE-0-2026-113695)
Vulnerability from cvelistv5
Published
2026-10-29 13:14
Modified
2026-10-29 13:50
Severity ?
4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113695",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:50:18.034363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T13:50:29.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT inline-image attachments"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.\u003c/p\u003e"
            }
          ],
          "value": "Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can introduce the content; another user must actively initiate the affected request."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:14:32.009Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113695",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113695/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Reflected Cross-Site Scripting in BMC ITSM SmartIT",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113695",
    "datePublished": "2026-10-29T13:14:32.009Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T13:50:29.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113694 (GCVE-0-2026-113694)
Vulnerability from cvelistv5
Published
2026-10-29 13:12
Modified
2026-10-29 13:51
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
Summary
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:50:57.458750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T13:51:08.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT user attachment feature"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.\u003c/p\u003e"
            }
          ],
          "value": "Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can perform the attack remotely without additional user interaction."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:12:52.855Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113694",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113694/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Improper Authorization in BMC ITSM SmartIT Attachments",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113694",
    "datePublished": "2026-10-29T13:12:52.855Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T13:51:08.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113693 (GCVE-0-2026-113693)
Vulnerability from cvelistv5
Published
2026-10-29 13:09
Modified
2026-10-29 13:59
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113693",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:59:19.332307Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T13:59:33.397Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT system-account settings"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.\u003c/p\u003e"
            }
          ],
          "value": "Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can perform the attack remotely without additional user interaction."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:09:39.803Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113693",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113693/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "System Account Credential Disclosure in BMC ITSM",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113693",
    "datePublished": "2026-10-29T13:09:39.803Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T13:59:33.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113692 (GCVE-0-2026-113692)
Vulnerability from cvelistv5
Published
2026-10-29 13:08
Modified
2026-10-29 14:00
Severity ?
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113692",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:59:50.568370Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:00:48.538Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT file management"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePath traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.\u003c/p\u003e"
            }
          ],
          "value": "Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated administrator can perform the attack remotely without additional user interaction."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:08:54.995Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113692",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113692/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Path Traversal in BMC ITSM",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113692",
    "datePublished": "2026-10-29T13:08:54.995Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T14:00:48.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113691 (GCVE-0-2026-113691)
Vulnerability from cvelistv5
Published
2026-10-29 13:07
Modified
2026-10-29 14:03
Severity ?
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:03:05.382503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:03:20.544Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT knowledge articles"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users\u0027 browsers.\u003c/p\u003e"
            }
          ],
          "value": "Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users\u0027 browsers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can introduce the content; another user must encounter the affected knowledge article."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:07:03.816Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113691",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113691/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Stored Cross-Site Scripting in BMC ITSM Knowledge Articles",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113691",
    "datePublished": "2026-10-29T13:07:03.816Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T14:03:20.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113690 (GCVE-0-2026-113690)
Vulnerability from cvelistv5
Published
2026-10-29 13:03
Modified
2026-10-29 14:05
Severity ?
4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:05:41.222863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:05:55.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT attachments"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users\u0027 browsers.\u003c/p\u003e"
            }
          ],
          "value": "Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users\u0027 browsers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can upload the content; another user must actively open the affected attachment."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:03:06.288Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113690",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Stored Cross-Site Scripting in BMC ITSM Attachments",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113690",
    "datePublished": "2026-10-29T13:03:06.288Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T14:05:55.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113689 (GCVE-0-2026-113689)
Vulnerability from cvelistv5
Published
2026-10-29 13:02
Modified
2026-10-29 14:06
Severity ?
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113689",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:06:13.315252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:06:24.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT work notes"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users\u0027 browsers.\u003c/p\u003e"
            }
          ],
          "value": "Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users\u0027 browsers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can introduce the content; another user must encounter the affected work note."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:02:34.909Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113689",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113689/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Stored Cross-Site Scripting in BMC ITSM Work Notes",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113689",
    "datePublished": "2026-10-29T13:02:34.909Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T14:06:24.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113688 (GCVE-0-2026-113688)
Vulnerability from cvelistv5
Published
2026-10-29 13:01
Modified
2026-10-29 14:06
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Summary
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
References
Impacted products
Vendor Product Version
BMC BMC IT Service Management Suite Version: 25.3.01   <
Patch: 25.3.01 hotfix 10
Version: 25.4.01   <
Patch: 25.4.01 hotfix 22
Version: 26.1.01   <
Patch: 26.1.01 hotfix 12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113688",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:06:38.781172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:06:49.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SmartIT URL-based attachments"
          ],
          "product": "BMC IT Service Management Suite",
          "vendor": "BMC",
          "versions": [
            {
              "status": "affected",
              "version": "25.3.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.3.01 hotfix 10",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "25.4.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.4.01 hotfix 22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "26.1.01",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "26.1.01 hotfix 12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Justin HOCQUEL, NCSC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eServer-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.\u003c/p\u003e"
            }
          ],
          "value": "Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "An authenticated user can perform the attack remotely without additional user interaction."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:01:46.475Z",
        "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "shortName": "NCSC"
      },
      "references": [
        {
          "name": "NCSC advisory CVE-2026-113688",
          "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113688/advisory.md"
        },
        {
          "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
        },
        {
          "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
          "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
            }
          ],
          "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Server-Side Request Forgery in BMC ITSM SmartIT",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
    "assignerShortName": "NCSC",
    "cveId": "CVE-2026-113688",
    "datePublished": "2026-10-29T13:01:46.475Z",
    "dateReserved": "2026-10-20T15:07:33.735Z",
    "dateUpdated": "2026-10-29T14:06:49.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}