Stored Cross-Site Scripting Vulnerability in BMC IT Service Management Suite

CVE-2026-113689

What is CVE-2026-113689?

A stored cross-site scripting vulnerability has been identified in the SmartIT work-notes feature of the BMC IT Service Management Suite. This issue allows authenticated users to inject and execute malicious scripts that are stored and subsequently run in the browsers of other users. The versions affected include 25.3.01, 25.4.01, and 26.1.01. Mitigating this vulnerability is crucial to safeguarding sensitive information and ensuring user security within the platform.

References