CVE-2026-113696

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113696", "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd", "state": "PUBLISHED", "assignerShortName": "NCSC", "dateReserved": "2026-10-20T15:07:33.735Z", "datePublished": "2026-10-29T13:29:15.025Z", "dateUpdated": "2026-10-29T13:49:59.814Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "47237f96-ddbe-4467-a5ee-293a770beacd", "shortName": "NCSC", "dateUpdated": "2026-10-29T13:29:15.025Z"}, "title": "Improper Authorization in BMC ITSM SmartIT Change Approvals", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "type": "CWE"}]}], "affected": [{"vendor": "BMC", "product": "BMC IT Service Management Suite", "modules": ["SmartIT change approval feature"], "versions": [{"status": "affected", "version": "25.3.01", "versionType": "custom"}, {"status": "unaffected", "version": "25.3.01 hotfix 10", "versionType": "custom"}, {"status": "affected", "version": "25.4.01", "versionType": "custom"}, {"status": "unaffected", "version": "25.4.01 hotfix 22", "versionType": "custom"}, {"status": "affected", "version": "26.1.01", "versionType": "custom"}, {"status": "unaffected", "version": "26.1.01 hotfix 12", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.</p>"}]}], "references": [{"url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md", "name": "NCSC advisory CVE-2026-113696"}, {"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/", "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues"}, {"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/", "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues"}, {"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/", "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "An authenticated user can perform the attack remotely without additional user interaction."}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.</p>"}]}], "credits": [{"lang": "en", "value": "Justin HOCQUEL, NCSC", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T13:49:45.547508Z", "id": "CVE-2026-113696", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T13:49:59.814Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113696", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T13:49:45.547508Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T13:49:53.447Z"}}], "cna": {"title": "Improper Authorization in BMC ITSM SmartIT Change Approvals", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Justin HOCQUEL, NCSC"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "An authenticated user can perform the attack remotely without additional user interaction."}]}], "affected": [{"vendor": "BMC", "modules": ["SmartIT change approval feature"], "product": "BMC IT Service Management Suite", "versions": [{"status": "affected", "version": "25.3.01", "versionType": "custom"}, {"status": "unaffected", "version": "25.3.01 hotfix 10", "versionType": "custom"}, {"status": "affected", "version": "25.4.01", "versionType": "custom"}, {"status": "unaffected", "version": "25.4.01 hotfix 22", "versionType": "custom"}, {"status": "affected", "version": "26.1.01", "versionType": "custom"}, {"status": "unaffected", "version": "26.1.01 hotfix 12", "versionType": "custom"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.", "supportingMedia": [{"type": "text/html", "value": "<p>Apply BMC IT Service Management Suite 25.3.01 hotfix 10, 25.4.01 hotfix 22, or 26.1.01 hotfix 12, as applicable.</p>", "base64": false}]}], "references": [{"url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md", "name": "NCSC advisory CVE-2026-113696"}, {"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/", "name": "BMC Helix Service Management 25.3.01 hotfix 10 corrected issues"}, {"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/", "name": "BMC Helix Service Management 25.4.01 hotfix 22 corrected issues"}, {"url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/", "name": "BMC Helix Service Management 26.1.01 hotfix 12 corrected issues"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "47237f96-ddbe-4467-a5ee-293a770beacd", "shortName": "NCSC", "dateUpdated": "2026-10-29T13:29:15.025Z"}}}, "cveMetadata": {"cveId": "CVE-2026-113696", "state": "PUBLISHED", "dateUpdated": "2026-10-29T13:49:59.814Z", "dateReserved": "2026-10-20T15:07:33.735Z", "assignerOrgId": "47237f96-ddbe-4467-a5ee-293a770beacd", "datePublished": "2026-10-29T13:29:15.025Z", "assignerShortName": "NCSC"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["SmartIT change approval feature"], "product": "BMC IT Service Management Suite", "vendor": "BMC", "versions": [{"status": "affected", "version": "25.3.01", "versionType": "custom"}, {"status": "unaffected", "version": "25.3.01 hotfix 10", "versionType": "custom"}, {"status": "affected", "version": "25.4.01", "versionType": "custom"}, {"status": "unaffected", "version": "25.4.01 hotfix 22", "versionType": "custom"}, {"status": "affected", "version": "26.1.01", "versionType": "custom"}, {"status": "unaffected", "version": "26.1.01 hotfix 12", "versionType": "custom"}]}], "source": "47237f96-ddbe-4467-a5ee-293a770beacd"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions."}], "id": "CVE-2026-113696", "lastModified": "2026-10-29T15:59:29.730", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "47237f96-ddbe-4467-a5ee-293a770beacd", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-113696", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T13:49:45.547508Z", "version": "2.0.3"}}]}, "published": "2026-10-29T14:17:45.233", "references": [{"source": "47237f96-ddbe-4467-a5ee-293a770beacd", "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25301/Release-notes-and-notices/Known-and-corrected-issues/"}, {"source": "47237f96-ddbe-4467-a5ee-293a770beacd", "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid25401/Release-notes-and-notices/Known-and-corrected-issues/"}, {"source": "47237f96-ddbe-4467-a5ee-293a770beacd", "url": "https://docs.helixops.ai/bin/Service-Management/On-Premises-Deployment/BMC-Helix-Service-Management-Deployment/brid26101/Release-notes-and-notices/Known-and-corrected-issues/"}, {"source": "47237f96-ddbe-4467-a5ee-293a770beacd", "url": "https://github.com/NCSC-Assess/Advisories/blob/main/advisories/2026/CVE-2026-113696/advisory.md"}], "sourceIdentifier": "47237f96-ddbe-4467-a5ee-293a770beacd", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "47237f96-ddbe-4467-a5ee-293a770beacd", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.3.01"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "25.3.01 hotfix 10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "25.4.01"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "25.4.01 hotfix 22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.1.01"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "26.1.01 hotfix 12"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "bmc_it_service_management_suite", "vendor": "bmc"}], "created": "2026-10-29T15:30:16.125136+00:00", "updated": "2026-10-30T23:14:02.657430+00:00", "vendors": ["bmc", "bmc$PRODUCT$bmc_it_service_management_suite"]}