CVE Feed

    Dashboard / CVE / CVE-2026-113688

    CVE-2026-113688

    Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.

    Published:Oct 29, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 29, 2026
    EPSS Score:0.00308
    CVSS Score:5.3

    Affected Products

    Vendor
    Bmc
    Product
    Bmc It Service Management Suite

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-113696 (CVSS 5.3) — Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113695 (CVSS 4.8) — Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Sui…
    CVE-2026-113694 (CVSS 5.3) — Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113693 (CVSS 5.3) — Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite ve…
    CVE-2026-113692 (CVSS 6.9) — Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.…
    CVE-2026-113691 (CVSS 5.1) — Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versio…
    CVE-2026-113690 (CVSS 4.8) — Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3…
    CVE-2026-113689 (CVSS 5.1) — Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High