CVE-2026-113691: Stored Cross-Site Scripting in BMC ITSM Knowledge Articles
Published Oct 29, 2026
·Updated
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.3.01Patch hotfix 10 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.4.01Patch hotfix 22 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 26.1.01Patch hotfix 12
Event History
Oct 29, 2026
CVE Published
via MITRE·01:07 PM
Data Sourced
via MITRE·01:07 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness