{"id":"CVE-2026-113690","kind":"vulnerability","aliases":["CVE-2026-113690"],"related":[],"title":"BMC ITSM SmartIT: stored XSS lets logged-in users run scripts","description":"Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.","summary":"BMC IT Service Management Suite's SmartIT attachment feature does not neutralize uploaded script content, so a stored cross-site scripting flaw exists. An authenticated user can make script run in other users' browsers.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","itsm","other","smartit"],"not_affected_if":["no-smartit","other-versions"],"how_to_check":"- Confirm whether BMC IT Service Management Suite with SmartIT is deployed and which version runs, against versions 25.3.01, 25.4.01 and 26.1.01.","fix":"- Versions 25.3.01, 25.4.01 and 26.1.01 are listed as affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-29T13:17:04+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","triaged_at":"2026-10-29T13:25:52+00:00","updated_at":"2026-10-29T13:25:52+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T13:25:52Z","model":"claude-haiku-5-5","output":{"fix":"- Versions 25.3.01, 25.4.01 and 26.1.01 are listed as affected; the sources do not name a fixed version.","reach":"network","title":"BMC ITSM SmartIT: stored XSS lets logged-in users run scripts","impact":"medium","summary":"BMC IT Service Management Suite's SmartIT attachment feature does not neutralize uploaded script content, so a stored cross-site scripting flaw exists. An authenticated user can make script run in other users' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["bmc","itsm","smartit"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in other users' browsers, enabling session or data theft","analyst_note":"Find the BMC advisory and fixed versions for SmartIT attachments; the NVD entry does not name a fix.","how_to_check":"- Confirm whether BMC IT Service Management Suite with SmartIT is deployed and which version runs, against versions 25.3.01, 25.4.01 and 26.1.01.\n- unknown for any further check; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","no-smartit"],"who_is_affected":"Teams running BMC IT Service Management Suite with the SmartIT attachment feature in the listed versions (25.3.01, 25.4.01, 26.1.01). Exposure requires an account, since the attacker must be an authenticated user who uploads content viewed by others. The sources do not say whether the default configuration is affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4116,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113690':15A,18A '-2026':14A,17A '25.3.01':75C '25.4.01':76C '26.1.01':78C 'allow':79C 'attach':30B,66C 'authent':48B,80C 'bmc':1A,19B,23B,69C 'browser':57B,90C 'content':37B,86C 'cross':42B,60C 'cross-sit':41B,59C 'cve':13A,16A 'execut':83C 'exist':46B 'featur':31B,67C 'flaw':45B 'itsm':2A,20B 'let':6A 'log':8A 'logged-in':7A 'make':51B 'manag':26B,72C 'neutral':34B 'run':11A,53B 'script':12A,36B,44B,52B,62C,85C 'servic':25B,71C 'site':43B,61C 'smartit':3A,22B,29B,65C 'store':4A,40B,58C 'suit':27B,73C 'upload':35B,84C 'user':10A,49B,56B,81C,89C 'version':74C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Teams running BMC IT Service Management Suite with the SmartIT attachment feature in the listed versions (25.3.01, 25.4.01, 26.1.01). Exposure requires an account, since the attacker must be an authenticated user who uploads content viewed by others. The sources do not say whether the default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"47237f96-ddbe-4467-a5ee-293a770beacd","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113690","severity":null,"published_at":"2026-10-29T13:17:04+00:00","modified_at":"2026-10-29T13:17:04+00:00","first_seen_at":"2026-10-29T13:25:07+00:00","fetched_at":"2026-10-29T13:25:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}