Stored Cross-Site Scripting in BMC ITSM Work Notes

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-113689 · Microsoft / collected KEV context

cve-program · CVE-2026-113689

• https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113689/advisory.md
• https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
• https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
• https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/

• Stored Cross-Site Scripting in BMC ITSM Work Notes · Newly collected advisory · 29 Oct 2026