Is CVE-2026-113697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113697 being exploited in the wild.

How severe is CVE-2026-113697?

Informational severity, published 29 October 2026.

Is there a fix for CVE-2026-113697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-113697 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-113697?

Check whether you run Bmc Helix Operations Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113697: BMC Helix Operations Management reflected XSS in agent query

CVE-2026-113697 · Severity: info · Published 2026-10-29

BMC Helix Operations Management is an IT operations platform that monitors and manages enterprise infrastructure. A reflected cross-site scripting vulnerability in the agent query feature allows an authenticated attacker to inject malicious scripts that execute in another user's browser when they click a crafted link. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim user.

Vendors: Bmc.

Quick answers

Is CVE-2026-113697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113697 being exploited in the wild.
How severe is CVE-2026-113697?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Bmc Helix Operations Management 25.4.00.
Is there a fix for CVE-2026-113697?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-113697 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-113697?: Check whether you run Bmc Helix Operations Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected XSS vulnerability exists in the agent query feature of BMC Helix Operations Management 25.4.00, where unsanitized user input is reflected back in HTTP responses. The attack requires the victim to click a malicious link and be authenticated to the application. An authenticated attacker can craft a URL that injects JavaScript code, which executes in the victim's browser with the victim's privileges.

Affected products

BMC Helix Operations Management 25.4.00

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.