BMC
Vulnerability activity for BMC: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 11
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 11
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 18
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 3
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 4.8MediumOct 29, 2026BMC Helix Operations Management XSSCVE-2026-113697Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
- 5.3MediumOct 29, 2026BMC IT Service Management Suite Auth bypass / access controlCVE-2026-113696Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
- 4.8MediumOct 29, 2026BMC IT Service Management Suite XSSCVE-2026-113695Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
- 5.3MediumOct 29, 2026BMC IT Service Management Suite Auth bypass / access controlCVE-2026-113694Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
- 5.3MediumOct 29, 2026BMC IT Service Management Suite Information disclosureCVE-2026-113693Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
- 6.9MediumOct 29, 2026BMC IT Service Management Suite Path traversal / file handlingCVE-2026-113692Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
- 5.1MediumOct 29, 2026BMC IT Service Management Suite XSSCVE-2026-113691Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
- 4.8MediumOct 29, 2026BMC IT Service Management Suite XSSCVE-2026-113690Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.
- 5.1MediumOct 29, 2026BMC IT Service Management Suite XSSCVE-2026-113689Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
- 5.3MediumOct 29, 2026BMC IT Service Management Suite SSRFCVE-2026-113688Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.
- 5.3MediumOct 27, 2026BMC Control-M/Enterprise Manager Auth bypass / access controlCVE-2026-10537A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earli
- 9.8CriticalApr 10, 2026Bmc control-m\/managed file transfer Auth bypass / access controlCVE-2026-23781An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.
- 7.5HighApr 10, 2026Bmc control-m\/managed file transfer Auth bypass / access controlCVE-2026-23782An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.
- 8.8HighApr 10, 2026Bmc control-m\/managed file transfer SQL injectionCVE-2026-23780An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable arbitrary file read/write operations and potentially lead to remote code execution.
- 8.8HighMar 19, 2026Bmc footprints DeserializationCVE-2025-71260BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20Detection
- 4.3MediumMar 19, 2026Bmc footprints SSRFCVE-2025-71259BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, NucleiDetection
- 4.3MediumMar 19, 2026Bmc footprints SSRFCVE-2025-71258BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 2NucleiDetection
- 7.3HighMar 19, 2026Bmc footprints Auth bypass / access controlCVE-2025-71257BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001NucleiDetection
Top products
- BMC IT Service Management Suite9 CVEs in the last year
- footprints4 CVEs in the last year
- control-m\/managed file transfer3 CVEs in the last year, 1 critical
- Control-M/Enterprise Manager1 CVE in the last year
- BMC Helix Operations Management1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.