Live › vulnerability › CVE-2026-113691
A stored cross-site scripting flaw in the SmartIT knowledge-article feature of BMC IT Service Management Suite lets a logged-in user save script that runs in other users' browsers. An attacker can use the victim's session to act as them inside the service desk tool.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Organizations running BMC IT Service Management Suite with the SmartIT knowledge-article feature in the affected versions. Exposure requires an authenticated account, so the risk is mainly from internal or partner users who can write knowledge articles.
No product ranges from the sources yet.
25.3.01, 25.4.01, or 26.1.01, the affected versions named in the description.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-113691")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.