{"id":"CVE-2026-113697","kind":"vulnerability","aliases":["CVE-2026-113697"],"related":[],"title":"BMC Helix Operations Management: reflected XSS in agent query feature","description":"Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.","summary":"A reflected cross-site scripting flaw in the agent query feature of BMC Helix Operations Management 25.4.00 lets an authenticated user run script in another user's browser. The victim has to open a crafted link for the script to run.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc-helix","itsm","other","web-apps"],"not_affected_if":["no-agent-query-feature","other-versions"],"how_to_check":"- Confirm the product and version: BMC Helix Operations Management `25.4.00`","fix":null,"status":"open","published_at":"2026-10-29T14:17:45+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:13+00:00","updated_at":"2026-10-29T14:26:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T14:26:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BMC Helix Operations Management: reflected XSS in agent query feature","impact":"medium","summary":"A reflected cross-site scripting flaw in the agent query feature of BMC Helix Operations Management 25.4.00 lets an authenticated user run script in another user's browser. The victim has to open a crafted link for the script to run.","audience":"businesses","category":"other","nicknames":[],"who_cares":["bmc-helix","itsm","web-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in another user's browser session","analyst_note":"Check the BMC advisory and NVD entry for affected version range, fixed release, and whether the agent query feature is on by default.","how_to_check":"- Confirm the product and version: BMC Helix Operations Management `25.4.00`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","no-agent-query-feature"],"who_is_affected":"Organizations running BMC Helix Operations Management 25.4.00 where users log in to the agent query feature. The sources do not describe other versions or configurations. Exposure requires an attacker with an account who can get a logged-in user to open a crafted link.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":4095,"output_tokens":481,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113697':13A,16A '-2026':12A,15A '25.4.00':42B,82C 'agent':8A,34B,74C 'allow':83C 'anoth':50B,90C 'app':24B 'attack':85C 'authent':45B,84C 'bmc':1A,18B,38B,78C 'bmc-helix':17B 'browser':53B,93C 'craft':60B,99C 'cross':28B,69C 'cross-sit':27B,68C 'cve':11A,14A 'execut':87C 'featur':10A,36B,76C 'flaw':31B 'helix':2A,19B,39B,79C 'itsm':20B 'let':43B 'link':61B,100C 'manag':4A,41B,81C 'open':58B,97C 'oper':3A,40B,80C 'queri':9A,35B,75C 'reflect':5A,26B,67C 'run':47B,66B 'script':30B,48B,64B,71C,88C 'site':29B,70C 'user':46B,51B,91C,96C 'victim':55B 'web':23B 'web-app':22B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Organizations running BMC Helix Operations Management 25.4.00 where users log in to the agent query feature. The sources do not describe other versions or configurations. Exposure requires an attacker with an account who can get a logged-in user to open a crafted link.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"47237f96-ddbe-4467-a5ee-293a770beacd","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113697","severity":null,"published_at":"2026-10-29T14:17:45+00:00","modified_at":"2026-10-29T14:17:45+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}