CVE-2026-113688: falha de média gravidade em BMC IT Service Management Suite
Server-Side Request Forgery in BMC ITSM SmartIT
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
BMC · BMC IT Service Management SuiteCVEs relacionadas — BMC IT Service Management Suite
No mesmo produto, das mais perigosas para as menos.
CVE-2026-113692MEDIUMPath Traversal in BMC ITSMEPSS 0.5%CVE-2026-113691MEDIUMStored Cross-Site Scripting in BMC ITSM Knowledge ArticlesEPSS 0.4%CVE-2026-113696MEDIUMImproper Authorization in BMC ITSM SmartIT Change ApprovalsEPSS 0.4%CVE-2026-113695MEDIUMReflected Cross-Site Scripting in BMC ITSM SmartITEPSS 0.3%CVE-2026-113690MEDIUMStored Cross-Site Scripting in BMC ITSM AttachmentsEPSS 0.3%CVE-2026-113689MEDIUMStored Cross-Site Scripting in BMC ITSM Work NotesEPSS 0.3%
Referências
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113688/advisory.md