CVE-2026-113696: fallo de gravedad media en BMC IT Service Management Suite
Improper Authorization in BMC ITSM SmartIT Change Approvals
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
BMC · BMC IT Service Management SuiteCVEs relacionadas — BMC IT Service Management Suite
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-113692MEDIUMPath Traversal in BMC ITSMEPSS 0.5%CVE-2026-113691MEDIUMStored Cross-Site Scripting in BMC ITSM Knowledge ArticlesEPSS 0.4%CVE-2026-113695MEDIUMReflected Cross-Site Scripting in BMC ITSM SmartITEPSS 0.3%CVE-2026-113690MEDIUMStored Cross-Site Scripting in BMC ITSM AttachmentsEPSS 0.3%CVE-2026-113689MEDIUMStored Cross-Site Scripting in BMC ITSM Work NotesEPSS 0.3%CVE-2026-113693MEDIUMSystem Account Credential Disclosure in BMC ITSMEPSS 0.3%
Referencias
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md