---
id: CVE-2026-113690
title: Stored Cross-Site Scripting in BMC ITSM Attachments
summary: >-
  Stored cross-site scripting in the SmartIT attachment feature of BMC IT
  Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows
  authenticated users to execute uploaded script content in other users'
  browsers.
severity: medium
cvss: 4.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: BMC
product: BMC IT Service Management Suite
affected:
  - it_service_management_suite 25.3.01
  - it_service_management_suite 25.4.01
  - it_service_management_suite 26.1.01
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T14:05:41.222863Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T14:05:55.037Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113690'
references:
  - url: >-
      https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md
    label: NCSC advisory CVE-2026-113690
  - url: >-
      https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
    label: BMC Helix Service Management 25.3.01 hotfix 10 corrected issues
  - url: >-
      https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
    label: BMC Helix Service Management 25.4.01 hotfix 22 corrected issues
  - url: >-
      https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/
    label: BMC Helix Service Management 26.1.01 hotfix 12 corrected issues
tags:
  - cve.org
epss: 0.00348
epssPercentile: 0.28566
ingestedAt: '2026-11-01T20:00:16.936Z'
---

## Overview

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

## Affected

- `it_service_management_suite 25.3.01`
- `it_service_management_suite 25.4.01`
- `it_service_management_suite 26.1.01`

## Remediation

Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.