The vulnerability is an SSRF flaw in the SmartIT URL‑based attachment feature that enables an authenticated user to cause the BMC server to send arbitrary HTTP requests to internal resources and read the responses. This does not lead to remote code execution but permits information disclosure, internal network reconnaissance, or assistance to other attacks. The weakness is improper validation of URL parameters, categorized as CWE-918.

BMC IT Service Management Suite SmartIT feature in versions 25.3.01, 25.4.01, and 26.1.01.

The CVSS score of 5.3 indicates moderate risk. EPSS is not available and the vulnerability is not listed in CISA KEV, implying low to moderate exploitation probability under current conditions. Exploitation requires an authenticated session, limiting the attack surface to legitimate users or compromised staff accounts, but the ability to target internal services can aid further malicious activity.