CVE-2026-113690: Stored Cross-Site Scripting in BMC ITSM Attachments

Published Oct 29, 2026

Updated

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

Event History

Oct 29, 2026

CVE Published

via MITRE·01:03 PM

Data Sourced

via MITRE·01:03 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the malicious content?

An authenticated user who can upload an attachment through the SmartIT attachment feature can exploit the issue. Other users are exposed when their browser renders the uploaded script content.

Is user interaction required for exploitation?

Yes. The CVSS vector indicates user interaction is required, meaning a victim must interact with content that causes the uploaded script to execute in their browser.

Which versions are identified as affected?

The affected versions listed are BMC IT Service Management Suite 25.3.01, 25.4.01, and 26.1.01.

CVE-2026-113690: Stored Cross-Site Scripting in BMC ITSM Attachments

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the malicious content?

Is user interaction required for exploitation?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the malicious content?

Is user interaction required for exploitation?

Which versions are identified as affected?