Live › vulnerability › CVE-2026-113689
BMC IT Service Management Suite versions 25.3.01, 25.4.01 and 26.1.01 let a logged-in user store a script in the SmartIT work-notes feature. The script runs in the browser of other users who view those notes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Organisations running BMC IT Service Management Suite with the SmartIT work-notes feature on the affected versions. Exposure depends on users being able to add work notes that other staff open in a browser. Teams not running those versions can skip it.
No product ranges from the sources yet.
unknown if the sources do not give the version command25.3.01, 25.4.01 or 26.1.01No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-113689")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.