CVE-2026-113695 in IT Service Management Suite
Summary
by MITRE • 10/29/2026
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 represents a classic instance of reflected cross-site scripting. This flaw arises from insufficient validation or sanitization of user-supplied input within the HTTP request parameters that control image attachments. When an authenticated user interacts with this feature by providing maliciously crafted data intended to be rendered as part of an inline image, the application fails to properly neutralize special characters before including them in the HTML response. Consequently, when another user views the affected page or attachment, their browser interprets the injected script content as executable code rather than static data. This mechanism allows attackers to execute arbitrary JavaScript within the context of the victim's session, bypassing standard security controls such as same-origin policy protections that typically isolate web applications from malicious scripts originating elsewhere.
From a technical perspective, this vulnerability aligns with CWE-79, which categorizes improper neutralization of input during web page generation processes. The reflected nature of the attack implies that the malicious payload is immediately returned in the HTTP response without being stored on the server for later retrieval by other users, although it can be delivered via phishing or social engineering tactics to trick victims into clicking a crafted link. This distinguishes it from persistent cross-site scripting where data is saved and served repeatedly. The specific vector involves the inline-image attachment functionality, suggesting that parameters related to image URLs, file names, or metadata are directly concatenated into HTML tags without adequate encoding. Attackers can exploit this by injecting script tags, event handlers such as onerror or onload, or other JavaScript constructs designed to interact with the Document Object Model of the victim's browser session.
The operational impact of this vulnerability is significant due to its potential for account takeover and data exfiltration within the BMC IT Service Management environment. Since the attack requires authentication, it targets legitimate users who have already bypassed initial access controls. Once a script executes in the context of an authenticated user, it can perform actions on behalf of that user without their knowledge or consent. This includes reading sensitive information displayed on the page, such as incident details, customer data, or internal service configurations. Furthermore, attackers can manipulate form submissions to change settings, create new tickets with malicious content, or exfiltrate session cookies and tokens to hijack the victim's account remotely. In enterprise IT environments where BMC SmartIT is used for critical infrastructure management, this could lead to unauthorized modifications of service levels, disruption of incident response workflows, or leakage of proprietary operational data.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. The primary technical fix involves implementing strict output encoding for all user-supplied data before it is rendered in HTML responses. Specifically, developers must ensure that special characters are escaped according to the context in which they appear, such as using HTML entity encoding for content inside tags or attribute values. Additionally, input validation should be enforced to reject any non-whitelisted characters or patterns associated with script injection. From a defense-in-depth perspective, deploying Content Security Policy headers can significantly reduce the impact of successful XSS attacks by restricting the sources from which scripts are allowed to load and execute. Organizations running affected versions must apply vendor-provided patches immediately upon availability. Until patching is complete, administrators should consider implementing web application firewall rules that detect and block common cross-site scripting payloads in HTTP requests targeting the SmartIT inline-image endpoints, thereby providing a temporary layer of protection against exploitation attempts.