CVE-2026-113690 (GCVE-0-2026-113690)
Vulnerability from cvelistv5
Published
2026-10-29 13:03
Modified
2026-10-29 14:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BMC | BMC IT Service Management Suite |
Version: 25.3.01 < Patch: 25.3.01 hotfix 10 Version: 25.4.01 < Patch: 25.4.01 hotfix 22 Version: 26.1.01 < Patch: 26.1.01 hotfix 12 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113690",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T14:05:41.222863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T14:05:55.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"SmartIT attachments"
],
"product": "BMC IT Service Management Suite",
"vendor": "BMC",
"versions": [
{
"status": "affected",
"version": "25.3.01",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "25.3.01 hotfix 10",
"versionType": "custom"
},
{
"status": "affected",
"version": "25.4.01",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "25.4.01 hotfix 22",
"versionType": "custom"
},
{
"status": "affected",
"version": "26.1.01",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "26.1.01 hotfix 12",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Justin HOCQUEL, NCSC"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users\u0027 browsers.\u003c/p\u003e"
}
],
"value": "Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users\u0027 browsers."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "An authenticated user can upload the content; another user must actively open the affected attachment."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T13:03:06.288Z",
"orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
"shortName": "NCSC"
},
"references": [
{
"name": "NCSC advisory CVE-2026-113690",
"url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md"
},
{
"name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues",
"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"
},
{
"name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues",
"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"
},
{
"name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues",
"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e"
}
],
"value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Stored Cross-Site Scripting in BMC ITSM Attachments",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
"assignerShortName": "NCSC",
"cveId": "CVE-2026-113690",
"datePublished": "2026-10-29T13:03:06.288Z",
"dateReserved": "2026-10-20T15:07:33.735Z",
"dateUpdated": "2026-10-29T14:05:55.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"47237f96-ddbe-4467-a5ee-293a770beacd\", \"shortName\": \"NCSC\", \"dateUpdated\": \"2026-10-29T13:03:06.288Z\"}, \"title\": \"Stored Cross-Site Scripting in BMC ITSM Attachments\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\", \"type\": \"CWE\"}]}], \"affected\": [{\"vendor\": \"BMC\", \"product\": \"BMC IT Service Management Suite\", \"modules\": [\"SmartIT attachments\"], \"versions\": [{\"status\": \"affected\", \"version\": \"25.3.01\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"25.3.01 hotfix 10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"25.4.01\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"25.4.01 hotfix 22\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"26.1.01\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"26.1.01 hotfix 12\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users\u0027 browsers.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eStored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users\u0027 browsers.\u003c/p\u003e\"}]}], \"references\": [{\"url\": \"https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md\", \"name\": \"NCSC advisory CVE-2026-113690\"}, {\"url\": \"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/\", \"name\": \"BMC Helix Service Management 25.3.01 hotfix 10 corrected issues\"}, {\"url\": \"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/\", \"name\": \"BMC Helix Service Management 25.4.01 hotfix 22 corrected issues\"}, {\"url\": \"https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/\", \"name\": \"BMC Helix Service Management 26.1.01 hotfix 12 corrected issues\"}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"An authenticated user can upload the content; another user must actively open the affected attachment.\"}], \"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"ACTIVE\", \"vulnConfidentialityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"version\": \"4.0\", \"baseSeverity\": \"MEDIUM\", \"baseScore\": 4.8, \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N\"}}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eApply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.\u003c/p\u003e\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Justin HOCQUEL, NCSC\", \"type\": \"finder\"}], \"source\": {\"discovery\": \"INTERNAL\"}, \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-113690\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-29T14:05:41.222863Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-29T14:05:48.388Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-113690\", \"assignerOrgId\": \"47237f96-ddbe-4467-a5ee-293a770beacd\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"NCSC\", \"dateReserved\": \"2026-10-20T15:07:33.735Z\", \"datePublished\": \"2026-10-29T13:03:06.288Z\", \"dateUpdated\": \"2026-10-29T14:05:55.037Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…