Live › vulnerability › CVE-2026-113697
A reflected cross-site scripting flaw in the agent query feature of BMC Helix Operations Management 25.4.00 lets an authenticated user run script in another user's browser. The victim has to open a crafted link for the script to run.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Organizations running BMC Helix Operations Management 25.4.00 where users log in to the agent query feature. The sources do not describe other versions or configurations. Exposure requires an attacker with an account who can get a logged-in user to open a crafted link.
No product ranges from the sources yet.
25.4.00No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
This page as .md · .json · in your agent: get_signal("CVE-2026-113697")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.