CVE-2026-113696

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions...

CVE-2026-113695

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

CVE-2026-113694

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users...

CVE-2026-113691

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers...

CVE-2026-113692

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory...

CVE-2026-113696 Improper Authorization in BMC ITSM SmartIT Change Approvals

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions...

CVE-2026-113696

The BMC IT Service Management Suite (versions 25.3.01 , 25.4.01 , and 26.1.01 ) contains an improper authorization vulnerability in the SmartIT change approval feature. This flaw allows authenticated users to make unauthorized changes to the approval state and bypass intended restrictions. No spe...

EUVD-2026-112828

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions...

CVE-2026-113688

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information...

CVE-2026-113689

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers...

CVE-2026-113690

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers...

CVE-2026-113695

Reflected cross-site scripting (XSS) exists in the SmartIT inline-image attachment feature of the BMC IT Service Management Suite (versions 25.3.01, 25.4.01, and 26.1.01). This vulnerability allows authenticated users to inject malicious script content into HTML responses viewed by other users. N...

CVE-2026-113695 Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

EUVD-2026-112827

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

CVE-2026-113694

The BMC IT Service Management Suite versions 25.3.01 , 25.4.01 , and 26.1.01 contain an improper authorization vulnerability within the SmartIT user attachment feature. This flaw allows authenticated users to unauthorizedly access or modify attachment resources belonging to other users. No specif...

CVE-2026-113694 Improper Authorization in BMC ITSM SmartIT Attachments

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users...

EUVD-2026-112824

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users...

CVE-2026-113693 System Account Credential Disclosure in BMC ITSM

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value...

CVE-2026-113693

The BMC IT Service Management Suite (versions 25.3.01, 25.4.01, and 26.1.01) is vulnerable to a credential disclosure flaw within the SmartIT system-account settings . This vulnerability allows authenticated users to retrieve a system username and an encrypted password value. The issue is categor...

CVE-2026-113692 Path Traversal in BMC ITSM

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory...