CVE-2026-113695: Reflected Cross-Site Scripting in BMC ITSM SmartIT

Published Oct 29, 2026

Updated

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade BMC IT Service Management Suite to a version that resolves this vulnerability.
Fixed in 25.3.01Patch hotfix 10
Upgrade
Upgrade BMC IT Service Management Suite to a version that resolves this vulnerability.
Fixed in 25.4.01Patch hotfix 22
Upgrade
Upgrade BMC IT Service Management Suite to a version that resolves this vulnerability.
Fixed in 26.1.01Patch hotfix 12

Event History

Oct 29, 2026

CVE Published

via MITRE·01:14 PM

Data Sourced

via MITRE·01:14 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the injected content?

An attacker must be an authenticated SmartIT user. The injected script content is executed in HTML responses viewed by another user.

Which deployments are identified as affected?

The issue is identified in BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01.

What feature should teams prioritize when assessing exposure?

Assessment should focus on the SmartIT inline-image attachment feature, where the reflected cross-site scripting occurs.