CVE-2026-113688Medium· 5.3▾ SunlitServer-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe re…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
it_service_management_suite 25.3.01it_service_management_suite 25.4.01it_service_management_suite 26.1.01Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113690Medium· 4.8Stored Cross-Site Scripting in BMC ITSM Attachments
CVE-2026-113689Medium· 5.1Stored Cross-Site Scripting in BMC ITSM Work Notes
CVE-2026-113691Medium· 5.1Stored Cross-Site Scripting in BMC ITSM Knowledge Articles
CVE-2026-113693Medium· 5.3System Account Credential Disclosure in BMC ITSM
CVE-2026-113692Medium· 6.9Path Traversal in BMC ITSM
CVE-2026-113694Medium· 5.3Improper Authorization in BMC ITSM SmartIT Attachments