Medium 4.8

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite...

CVE-2026-113690 First seen on SecPulse Oct 29, 22:03

Affected packages

Ecosystem	Package	Affected	Fixed
BMC	BMC IT Service Management Suite	—	—

Original description The description as published by the source.

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v4: Medium 4.8; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Published: Oct 29, 2026
First seen on SecPulse: Oct 29, 22:03
GHSA: GHSA-cqv3-5726-fh5h
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Bmc Bmc It Service Management Suite

Detection sources

NIST National Vulnerability Database00:59
GitHub Security Advisories (Global)00:30
CVE.org (CVE Program・cvelistV5)Oct 29, 23:05