{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-113690",
        "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
        "state": "PUBLISHED",
        "assignerShortName": "NCSC",
        "dateReserved": "2026-10-20T15:07:33.735Z",
        "datePublished": "2026-10-29T13:03:06.288Z",
        "dateUpdated": "2026-10-29T14:05:55.037Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "47237f96-ddbe-4467-a5ee-293a770beacd",
                "shortName": "NCSC",
                "dateUpdated": "2026-10-29T13:03:06.288Z"
            },
            "title": "Stored Cross-Site Scripting in BMC ITSM Attachments",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-79",
                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "BMC",
                    "product": "BMC IT Service Management Suite",
                    "modules": [
                        "SmartIT attachments"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "25.3.01",
                            "versionType": "custom"
                        },
                        {
                            "status": "unaffected",
                            "version": "25.3.01 hotfix 10",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "25.4.01",
                            "versionType": "custom"
                        },
                        {
                            "status": "unaffected",
                            "version": "25.4.01 hotfix 22",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "26.1.01",
                            "versionType": "custom"
                        },
                        {
                            "status": "unaffected",
                            "version": "26.1.01 hotfix 12",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unknown"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.</p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113690/advisory.md",
                    "name": "NCSC advisory CVE-2026-113690"
                },
                {
                    "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/",
                    "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues"
                },
                {
                    "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/",
                    "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues"
                },
                {
                    "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/",
                    "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues"
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "An authenticated user can upload the content; another user must actively open the affected attachment."
                        }
                    ],
                    "cvssV4_0": {
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "privilegesRequired": "LOW",
                        "userInteraction": "ACTIVE",
                        "vulnConfidentialityImpact": "NONE",
                        "subConfidentialityImpact": "LOW",
                        "vulnIntegrityImpact": "NONE",
                        "subIntegrityImpact": "LOW",
                        "vulnAvailabilityImpact": "NONE",
                        "subAvailabilityImpact": "NONE",
                        "exploitMaturity": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "valueDensity": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "version": "4.0",
                        "baseSeverity": "MEDIUM",
                        "baseScore": 4.8,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
                    }
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.</p>"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Justin HOCQUEL, NCSC",
                    "type": "finder"
                }
            ],
            "source": {
                "discovery": "INTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.5"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-10-29T14:05:41.222863Z",
                                "id": "CVE-2026-113690",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-10-29T14:05:55.037Z"
                }
            }
        ]
    }
}