Description
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BMC BMC IT Service Management Suite
Default version status: unknown
25.3.01affected25.3.01 hotfix 10unaffected25.4.01affected25.4.01 hotfix 22unaffected26.1.01affected26.1.01 hotfix 12unaffected
References
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113688/advisory.md ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/ ↗