Live › vulnerability › CVE-2026-113693
In BMC IT Service Management Suite versions 25.3.01, 25.4.01 and 26.1.01, the SmartIT system-account settings reveal a system username and an encrypted password value to logged-in users. An authenticated user can retrieve these values, which may let them attempt to recover the account credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Organisations running BMC IT Service Management Suite 25.3.01, 25.4.01 or 26.1.01 with SmartIT enabled are exposed. The attacker needs a valid user account on the platform. Teams not running these versions can skip it.
No product ranges from the sources yet.
25.3.01, 25.4.01 or 26.1.01No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
This page as .md · .json · in your agent: get_signal("CVE-2026-113693")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.