CVE-2026-113692: falha de média gravidade em BMC IT Service Management Suite
Path Traversal in BMC ITSM
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.5%
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
BMC · BMC IT Service Management SuiteCVEs relacionadas — BMC IT Service Management Suite
No mesmo produto, das mais perigosas para as menos.
CVE-2026-113691MEDIUMStored Cross-Site Scripting in BMC ITSM Knowledge ArticlesEPSS 0.4%CVE-2026-113696MEDIUMImproper Authorization in BMC ITSM SmartIT Change ApprovalsEPSS 0.4%CVE-2026-113695MEDIUMReflected Cross-Site Scripting in BMC ITSM SmartITEPSS 0.3%CVE-2026-113690MEDIUMStored Cross-Site Scripting in BMC ITSM AttachmentsEPSS 0.3%CVE-2026-113689MEDIUMStored Cross-Site Scripting in BMC ITSM Work NotesEPSS 0.3%CVE-2026-113693MEDIUMSystem Account Credential Disclosure in BMC ITSMEPSS 0.3%
Referências
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113692/advisory.md