PT-2026-132111

CVE-2026-113688

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 4.0
5.3
Medium
MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-918: Server-Side Request Forgery (SSRF)
Related identifiers
CVE-2026-113688
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com