CVE-2026-113695Medium· 4.8▾ SunlitReflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by ano…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
it_service_management_suite 25.3.01it_service_management_suite 25.4.01it_service_management_suite 26.1.01Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113690Medium· 4.8Stored Cross-Site Scripting in BMC ITSM Attachments
CVE-2026-113689Medium· 5.1Stored Cross-Site Scripting in BMC ITSM Work Notes
CVE-2026-113691Medium· 5.1Stored Cross-Site Scripting in BMC ITSM Knowledge Articles
CVE-2026-113688Medium· 5.3Server-Side Request Forgery in BMC ITSM SmartIT
CVE-2026-113693Medium· 5.3System Account Credential Disclosure in BMC ITSM
CVE-2026-113692Medium· 6.9Path Traversal in BMC ITSM