Medium severity · published Oct 29, 2026
CVE-2026-113695
Reflected Cross-Site Scripting in BMC ITSM SmartIT
New
4.8
CVSS
–
EPSS
No
On KEV
Description
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
BMC IT Service Management Suite · BMC
25.3.01; 25.4.01; 26.1.01 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113695
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113695
github.com
https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113695/advisory.md
docs.helixops.ai
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
docs.helixops.ai
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
docs.helixops.ai
https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/
More from BMC IT Service Management Suite
6.9
CVE-2026-113692
Path Traversal in BMC ITSM
5.3
CVE-2026-113696
Improper Authorization in BMC ITSM SmartIT Change Approvals
5.3
CVE-2026-113694
Improper Authorization in BMC ITSM SmartIT Attachments
5.3
CVE-2026-113693
System Account Credential Disclosure in BMC ITSM
5.3
CVE-2026-113688
Server-Side Request Forgery in BMC ITSM SmartIT