{"id":"CVE-2026-113691","kind":"vulnerability","aliases":["CVE-2026-113691"],"related":[],"title":"BMC ITSM SmartIT: stored script in knowledge articles runs in other users' browsers","description":"Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.","summary":"A stored cross-site scripting flaw in the SmartIT knowledge-article feature of BMC IT Service Management Suite lets a logged-in user save script that runs in other users' browsers. An attacker can use the victim's session to act as them inside the service desk tool.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","itsm","other","service-desk","smartit"],"not_affected_if":["no-smartit-knowledge-articles","unaffected-version"],"how_to_check":"- Confirm whether the BMC IT Service Management Suite with SmartIT is deployed, and note its version.\n- Check whether the installed version is `25.3.01`, `25.4.01`, or `26.1.01`, the affected versions named in the description.","fix":null,"status":"open","published_at":"2026-10-29T14:17:44+00:00","first_seen_at":"2026-10-29T14:25:22+00:00","triaged_at":"2026-10-29T14:26:13+00:00","updated_at":"2026-10-29T14:26:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T14:26:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BMC ITSM SmartIT: stored script in knowledge articles runs in other users' browsers","impact":"medium","summary":"A stored cross-site scripting flaw in the SmartIT knowledge-article feature of BMC IT Service Management Suite lets a logged-in user save script that runs in other users' browsers. An attacker can use the victim's session to act as them inside the service desk tool.","audience":"businesses","category":"other","nicknames":[],"who_cares":["bmc","itsm","smartit","service-desk"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in other users' sessions, exposing their browser-based access","analyst_note":"Check the BMC advisory for the vendor fix version and whether a patch is available for 25.3.01, 25.4.01, and 26.1.01.","how_to_check":"- Confirm whether the BMC IT Service Management Suite with SmartIT is deployed, and note its version.\n- Check whether the installed version is `25.3.01`, `25.4.01`, or `26.1.01`, the affected versions named in the description.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-smartit-knowledge-articles"],"who_is_affected":"Organizations running BMC IT Service Management Suite with the SmartIT knowledge-article feature in the affected versions. Exposure requires an authenticated account, so the risk is mainly from internal or partner users who can write knowledge articles.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4114,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113691':16A,19A '-2026':15A,18A '25.3.01':97C '25.4.01':98C '26.1.01':100C 'act':70B 'allow':101C 'articl':8A,39B,88C 'attack':62B 'authent':102C 'bmc':1A,20B,42B,91C 'browser':13A,60B,111C 'cross':30B,80C 'cross-sit':29B,79C 'cve':14A,17A 'desk':25B,76B 'execut':105C 'featur':40B,89C 'flaw':33B 'insid':73B 'itsm':2A,21B 'knowledg':7A,38B,87C 'knowledge-articl':37B,86C 'let':47B 'log':50B 'logged-in':49B 'manag':45B,94C 'run':9A,56B 'save':53B 'script':5A,32B,54B,82C,107C 'servic':24B,44B,75B,93C 'service-desk':23B 'session':68B 'site':31B,81C 'smartit':3A,26B,36B,85C 'store':4A,28B,78C,106C 'suit':46B,95C 'tool':77B 'use':64B 'user':12A,52B,59B,103C,110C 'version':96C 'victim':66B","nicknames":[],"mitigations":[],"who_affected":"Organizations running BMC IT Service Management Suite with the SmartIT knowledge-article feature in the affected versions. Exposure requires an authenticated account, so the risk is mainly from internal or partner users who can write knowledge articles.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"47237f96-ddbe-4467-a5ee-293a770beacd","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113691","severity":null,"published_at":"2026-10-29T14:17:44+00:00","modified_at":"2026-10-29T14:17:44+00:00","first_seen_at":"2026-10-29T14:25:22+00:00","fetched_at":"2026-10-29T14:25:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}