CVE-2026-113690: falha de média gravidade em BMC IT Service Management Suite
Stored Cross-Site Scripting in BMC ITSM Attachments
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.3%
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
BMC · BMC IT Service Management SuiteCVEs relacionadas — BMC IT Service Management Suite
No mesmo produto, das mais perigosas para as menos.
CVE-2026-113692MEDIUMPath Traversal in BMC ITSMEPSS 0.5%CVE-2026-113691MEDIUMStored Cross-Site Scripting in BMC ITSM Knowledge ArticlesEPSS 0.4%CVE-2026-113696MEDIUMImproper Authorization in BMC ITSM SmartIT Change ApprovalsEPSS 0.4%CVE-2026-113695MEDIUMReflected Cross-Site Scripting in BMC ITSM SmartITEPSS 0.3%CVE-2026-113689MEDIUMStored Cross-Site Scripting in BMC ITSM Work NotesEPSS 0.3%CVE-2026-113693MEDIUMSystem Account Credential Disclosure in BMC ITSMEPSS 0.3%
Referências
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md