CVE-2026-113690
Received
Received - Intake
Stored XSS in BMC IT Service Management Suite Attachment Feature
Vulnerability report for CVE-2026-113690, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-29
Last updated on: 2026-10-29
Assigner: 47237f96-ddbe-4467-a5ee-293a770beacd
Description
Description
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| BMC | BMC IT Service Management Suite | 25.3.01 |
| BMC | BMC IT Service Management Suite | 25.4.01 |
| BMC | BMC IT Service Management Suite | 26.1.01 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
