Server-Side Request Forgery in BMC IT Service Management Suite
CVE-2026-113688

5.3MEDIUM

Key Information:

Vendor

Bmc

Status
Bmc It Service Management Suite
Vendor
CVE Published:
29 October 2026

What is CVE-2026-113688?

A vulnerability in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 exists that permits authenticated users to perform server-side requests to internal services. This could potentially expose sensitive response information, compromising the security of internal systems. It is critical for organizations using affected versions to implement mitigation measures to protect against unauthorized access.

Affected Version(s)

BMC IT Service Management Suite 25.3.01

BMC IT Service Management Suite 25.4.01

BMC IT Service Management Suite 26.1.01

References

https://github.com/NCSC-Assess/Advisories/blob/main/advis...
https://docs.helixops.ai/bin/Service-Management/On-Premis...
https://docs.helixops.ai/bin/Service-Management/On-Premis...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Justin HOCQUEL, NCSC
.