Live › vulnerability › CVE-2026-113688
BMC IT Service Management Suite's SmartIT URL-based attachment feature can be made to send server-side requests to internal services. An authenticated user can read the response information returned from those internal systems.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Organizations running BMC IT Service Management Suite versions 25.3.01, 25.4.01, or 26.1.01 with the SmartIT URL-based attachment feature available to users. The sources do not describe further configuration conditions. Teams on other versions or without SmartIT are not named as affected.
No product ranges from the sources yet.
25.3.01, 25.4.01, or 26.1.01No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
This page as .md · .json · in your agent: get_signal("CVE-2026-113688")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.