Vulnerability Description
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
Related Weaknesses (CWE)
References
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113
FAQ
What is CVE-2026-113694?
CVE-2026-113694 is a documented vulnerability. Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resour...
How severe is CVE-2026-113694?
CVSS scoring is not yet available for CVE-2026-113694. Check NVD for updates.
Is there a patch for CVE-2026-113694?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.