CVE-2026-113690 in IT Service Management Suite
Summary
by MITRE • 10/29/2026
Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as a stored cross-site scripting flaw within the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 represents a significant security risk to enterprise environments relying on this platform for service management operations. This specific vulnerability allows authenticated users to inject malicious script content into attachments uploaded through the system. Unlike reflected cross-site scripting where payload execution is tied to immediate user interaction with a crafted link, stored vulnerabilities persist within the application's data store. Consequently, when other authorized users access or view these compromised attachments, their browsers automatically execute the injected scripts without further intervention from the attacker. This persistence mechanism amplifies the potential impact by enabling automated attacks that do not require social engineering tactics to trick victims into clicking specific links, thereby increasing the likelihood of successful exploitation across a broader user base within the organization.
From a technical perspective, this flaw stems from insufficient input validation and output encoding mechanisms during the processing of file attachments. The application fails to properly sanitize script tags or event handlers embedded in uploaded files before storing them in the database and subsequently rendering them back to users' browsers. This lack of rigorous sanitization allows malicious JavaScript code to be stored alongside legitimate data. When a victim user navigates to an interface that displays these attachments, the browser interprets the stored content as executable script rather than inert text or safe file types. The execution context is typically within the same origin as the application, granting the injected scripts full access to session cookies, local storage, and other sensitive client-side data associated with the victim's active session on the BMC SmartIT platform.
The operational impact of this vulnerability extends beyond simple defacement or minor annoyances. Attackers can leverage stored cross-site scripting for a variety of malicious activities including credential theft via keylogging scripts that capture usernames and passwords entered into login forms, session hijacking by stealing authentication tokens to impersonate legitimate users, and phishing attacks where the attacker injects fake login pages or fraudulent service request forms directly into the trusted interface. Furthermore, because BMC IT Service Management Suite often handles sensitive corporate data including incident reports, change management records, and configuration item details, an attacker could potentially exfiltrate this confidential information by sending it to a remote server controlled by the adversary. The ability to execute arbitrary JavaScript also allows for drive-by downloads or exploitation of other browser-side vulnerabilities if present in the victim's environment, further escalating the risk profile.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the subcategory of Stored XSS which is categorized as CWE-805. In terms of adversary tactics, this exploitation technique maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing arbitrary code within the browser context and potentially T1534 Internal Spearphishing if used to deceive users into performing actions that compromise organizational security posture. The persistence aspect also relates to T1207 Rogue Domain Controller or similar persistence mechanisms depending on how long the malicious scripts remain active in the system before detection.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. BMC has released patches for versions 25.3.01, 25.4.01, and 26.1.01 to address this issue; organizations should prioritize applying these updates as soon as possible after verifying compatibility with their existing infrastructure. In addition to patching, administrators should implement strict Content Security Policy headers that restrict the execution of inline scripts and limit script sources to trusted domains only. Input validation must be enforced at multiple layers ensuring that all file uploads are scanned for malicious content using advanced antivirus or sandboxing solutions before being stored in the database. Output encoding should also be applied consistently whenever user-supplied data is rendered in HTML contexts to prevent browser interpretation of injected payloads as executable code. Regular security audits and penetration testing focused on web application vulnerabilities will help identify similar weaknesses across other modules within the BMC suite ensuring a more robust defense against cross-site scripting attacks.