CVE-2026-113694
CVE-2026-113694 · Improper Authorization in BMC ITSM SmartIT Attachments
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
CVSS 5.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
bmc it service management suite
- Versions
- 25.3.01: Affected (custom)
- 25.3.01 hotfix 10: Not affected (custom)
- 25.4.01: Affected (custom)
- 25.4.01 hotfix 22: Not affected (custom)
- 26.1.01: Affected (custom)
- 26.1.01 hotfix 12: Not affected (custom)
Update to 25.4.01 hotfix 22; Update to 26.1.01 hotfix 12
Original sources
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113694/advisory.md
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/
- https://nvd.nist.gov/vuln/detail/CVE-2026-113694