Description
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BMC BMC IT Service Management Suite
Default version status: unknown
25.3.01affected25.3.01 hotfix 10unaffected25.4.01affected25.4.01 hotfix 22unaffected26.1.01affected26.1.01 hotfix 12unaffected
References
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113693/advisory.md ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/ ↗