it_service_management_suite vulnerabilities

CVEs whose affected-version data names the it_service_management_suite package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

9 CVEsRSS

CVE-2026-113690Medium· 4.8

1w ago

Stored Cross-Site Scripting in BMC ITSM Attachments

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.35%via CVEORG

CVE-2026-113688Medium· 5.3

1w ago

Server-Side Request Forgery in BMC ITSM SmartIT

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe re…

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.31%via CVEORG

CVE-2026-113689Medium· 5.1

1w ago

Stored Cross-Site Scripting in BMC ITSM Work Notes

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.35%via CVEORG

CVE-2026-113691Medium· 5.1

1w ago

Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.43%via CVEORG

CVE-2026-113693Medium· 5.3

1w ago

System Account Credential Disclosure in BMC ITSM

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.34%via CVEORG

CVE-2026-113692Medium· 6.9

1w ago

Path Traversal in BMC ITSM

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.47%via CVEORG

CVE-2026-113694Medium· 5.3

1w ago

Improper Authorization in BMC ITSM SmartIT Attachments

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.31%via CVEORG

CVE-2026-113695Medium· 4.8

1w ago

Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by ano…

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.35%via CVEORG

CVE-2026-113696Medium· 5.3

1w ago

Improper Authorization in BMC ITSM SmartIT Change Approvals

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approva…

▾ SunlitBMC · BMC IT Service Management SuiteEPSS 0.40%via CVEORG