CVE-2026-113697Medium· 4.8▾ SunlitReflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
helix_operations_management 25.4.00No fixed version has been confirmed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113690Medium· 4.8Stored Cross-Site Scripting in BMC ITSM Attachments
CVE-2026-113689Medium· 5.1Stored Cross-Site Scripting in BMC ITSM Work Notes
CVE-2026-113691Medium· 5.1Stored Cross-Site Scripting in BMC ITSM Knowledge Articles
CVE-2026-113695Medium· 4.8Reflected Cross-Site Scripting in BMC ITSM SmartIT
CVE-2017-17678Medium· 6.1BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS)
CVE-2026-113688Medium· 5.3Server-Side Request Forgery in BMC ITSM SmartIT