Live › vulnerability › CVE-2026-113690
BMC IT Service Management Suite's SmartIT attachment feature does not neutralize uploaded script content, so a stored cross-site scripting flaw exists. An authenticated user can make script run in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
Teams running BMC IT Service Management Suite with the SmartIT attachment feature in the listed versions (25.3.01, 25.4.01, 26.1.01). Exposure requires an account, since the attacker must be an authenticated user who uploads content viewed by others. The sources do not say whether the default configuration is affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-113690")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.