BMC IT Service Management Suite's SmartIT attachment feature stored malicious script content submitted by an authenticated user, allowing that script to be executed in the browsers of other users who view the attachment. This flaw can enable attackers to hijack sessions, exfiltrate data, or perform defacement or other client‑side attacks against any users who open the affected attachment. The weakness is an example of an input validation flaw that results in a stored cross‑site scripting vulnerability, identified as CWE‑79.

BMC IT Service Management Suite, versions 25.3.01, 25.4.01, and 26.1.01.

The CVSS score of 4.8 indicates moderate overall risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not widely exploited yet. The vulnerability requires an attacker to be an authenticated user of the affected product and to upload a crafted attachment, after which the malicious script will run in the browsers of other users who view that attachment. Once the script executes, it can perform actions that compromise confidentiality and integrity of the affected systems.