Description
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BMC BMC IT Service Management Suite
Default version status: unknown
25.3.01affected25.3.01 hotfix 10unaffected25.4.01affected25.4.01 hotfix 22unaffected26.1.01affected26.1.01 hotfix 12unaffected
References
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113695/advisory.md ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/ ↗
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/ ↗