CVE-2026-113695: falha de média gravidade em BMC IT Service Management Suite
Reflected Cross-Site Scripting in BMC ITSM SmartIT
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.3%
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
BMC · BMC IT Service Management SuiteCVEs relacionadas — BMC IT Service Management Suite
No mesmo produto, das mais perigosas para as menos.
CVE-2026-113692MEDIUMPath Traversal in BMC ITSMEPSS 0.5%CVE-2026-113691MEDIUMStored Cross-Site Scripting in BMC ITSM Knowledge ArticlesEPSS 0.4%CVE-2026-113696MEDIUMImproper Authorization in BMC ITSM SmartIT Change ApprovalsEPSS 0.4%CVE-2026-113690MEDIUMStored Cross-Site Scripting in BMC ITSM AttachmentsEPSS 0.3%CVE-2026-113689MEDIUMStored Cross-Site Scripting in BMC ITSM Work NotesEPSS 0.3%CVE-2026-113693MEDIUMSystem Account Credential Disclosure in BMC ITSMEPSS 0.3%
Referências
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113695/advisory.md