CVE-2026-113696
CVE-2026-113696 · Improper Authorization in BMC ITSM SmartIT Change Approvals
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
CVSS 5.3 · Средний · EPSS 0,4% · Есть исправление
- Опубликовано
- Обновлено
Затронутые продукты и версии
bmc it service management suite
- Версии
- 25.3.01: Затронуто (custom)
- 25.3.01 hotfix 10: Не затронуто (custom)
- 25.4.01: Затронуто (custom)
- 25.4.01 hotfix 22: Не затронуто (custom)
- 26.1.01: Затронуто (custom)
- 26.1.01 hotfix 12: Не затронуто (custom)
Обновитесь до 25.4.01 hotfix 22; Обновитесь до 26.1.01 hotfix 12
Первоисточники
- https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/
- https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/
- https://nvd.nist.gov/vuln/detail/CVE-2026-113696