CVE-2026-113693: System Account Credential Disclosure in BMC ITSM
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.3.01Patch hotfix 10 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 25.4.01Patch hotfix 22 - Upgrade
Upgrade
BMC IT Service Management Suiteto a version that resolves this vulnerability.Fixed in 26.1.01Patch hotfix 12
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be an authenticated user of the affected BMC IT Service Management Suite deployment. The disclosed information is available through the SmartIT system-account settings.
What information can be obtained?
Affected users can retrieve a system username and an encrypted password value. The available information does not state whether the encrypted password can be decrypted or used directly for authentication.
Which versions are affected?
The issue affects BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01.