CVE-2026-113689: Stored Cross-Site Scripting in BMC ITSM Work Notes
Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.3.01Patch hotfix 10 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.4.01Patch hotfix 22 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 26.1.01Patch hotfix 12
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk from the payload?
An authenticated user can store a script through the SmartIT work-notes feature. Other users are at risk when their browsers render the affected stored work note.
Do unauthenticated users need access to exploit it?
No. The vulnerability requires an authenticated user, so an attacker needs valid access to the affected BMC IT Service Management Suite instance.
Which deployments should be prioritized for review?
Review BMC IT Service Management Suite deployments running versions 25.3.01, 25.4.01, or 26.1.01 where SmartIT work notes are used. The provided information does not establish whether other versions are affected.