CVE-2026-113688: Server-Side Request Forgery in BMC ITSM SmartIT
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.3.01Patch hotfix 10 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.4.01Patch hotfix 22 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 26.1.01Patch hotfix 12
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be an authenticated SmartIT user. The issue is exposed through the URL-based attachment feature.
Which deployments are known to be affected?
BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 are identified as affected.
What could an attacker do with successful exploitation?
An authenticated user can cause the SmartIT server to send requests to internal services and observe response information. The stated impact is on systems beyond the vulnerable component rather than on the vulnerable component's own confidentiality, integrity, or availability.