CVE-2026-113697: Reflected Cross-Site Scripting in BMC Helix Operations Management
Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to BMC Helix Operations Management and able to use the agent query feature. Exploitation also requires convincing another user to open a crafted link.
What is the impact on a successful exploit?
The attacker can execute script in the browser of the user who opens the crafted link. The provided vector indicates no direct impact to confidentiality, integrity, or availability of the vulnerable system, but indicates subsequent confidentiality and integrity impact in the affected browser context.
How can I determine whether we are affected?
The issue is identified as affecting BMC Helix Operations Management 25.4.00 and specifically involves the agent query feature. Review whether that version is deployed and whether authenticated users can access or send links involving agent queries.