CVE-2026-113690
CVE-2026-113690 · Stored Cross-Site Scripting in BMC ITSM Attachments
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
CVSS 4.8 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
bmc it service management suite
- Versiones
- 25.3.01: Afectada (custom)
- 25.3.01 hotfix 10: No afectada (custom)
- 25.4.01: Afectada (custom)
- 25.4.01 hotfix 22: No afectada (custom)
- 26.1.01: Afectada (custom)
- 26.1.01 hotfix 12: No afectada (custom)
Actualiza a 25.4.01 hotfix 22; Actualiza a 26.1.01 hotfix 12
Fuentes originales
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/
- https://nvd.nist.gov/vuln/detail/CVE-2026-113690