A stored cross‑site scripting flaw exists in the SmartIT work‑notes feature of BMC IT Service Management Suite. Authenticated users can inject and store arbitrary JavaScript that is subsequently rendered when another user views the work note. This misuse of the input field permits an attacker to execute scripts in victim browsers, potentially stealing session cookies, credentials, defacing content, or executing other client‑side attacks. The weakness is a classic input validation issue classified under CWE‑79.

The vulnerability affects BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. BMC is the vendor; the affected product is the Work Notes component within the Helix Service Management Suite.

The CVSS score of 5.1 indicates a medium impact. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying the current exploitation probability is uncertain. The attack requires the attacker to be authenticated and to have the ability to add or modify work‑note entries, thus limiting the threat to users with sufficient permissions. Successful exploitation would lead to client‑side code execution and email‑and‑cookie theft on the victim’s machine.