# Bmc vulnerabilities Source: https://junglewise.ai/threats/vendors/bmc Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/bmc.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in Bmc: 0 in the last 7 days and 11 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113697, was published on 29 October 2026. 11 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. 5 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 11 - Last 90 days: 11 - All time: 18 (2 critical, 0 exploited in the wild) ## About Bmc BMC Software is an enterprise software company providing IT operations management and business service management solutions. ## Latest Bmc vulnerabilities - [CVE-2026-113697: BMC Helix Operations Management reflected XSS in agent query](https://junglewise.ai/threats/cve-2026-113697-reflected-cross-site-scripting-in-the-agent-query-feature-of-bmc) (info, published 29 Oct 2026) - [CVE-2026-113696: BMC IT Service Management Suite authorization bypass in SmartIT change approval](https://junglewise.ai/threats/cve-2026-113696-improper-authorization-in-the-smartit-change-approval-feature-of) (info, published 29 Oct 2026) - [CVE-2026-113695: BMC IT Service Management Suite reflected XSS in inline-image attachment](https://junglewise.ai/threats/cve-2026-113695-reflected-cross-site-scripting-in-the-smartit-inline-image) (info, published 29 Oct 2026) - [CVE-2026-113694: BMC IT Service Management Suite improper authorization in SmartIT](https://junglewise.ai/threats/cve-2026-113694-improper-authorization-in-the-smartit-user-attachment-feature-of) (info, published 29 Oct 2026) - [CVE-2026-113693: BMC IT Service Management Suite information disclosure in SmartIT](https://junglewise.ai/threats/cve-2026-113693-exposure-of-sensitive-information-in-the-smartit-system-account) (info, published 29 Oct 2026) - [CVE-2026-113692: BMC IT Service Management Suite path traversal in SmartIT file-management](https://junglewise.ai/threats/cve-2026-113692-path-traversal-in-the-smartit-file-management-feature-of-bmc-it) (info, published 29 Oct 2026) - [CVE-2026-113691: BMC IT Service Management Suite stored XSS in SmartIT knowledge article](https://junglewise.ai/threats/cve-2026-113691-stored-cross-site-scripting-in-the-smartit-knowledge-article) (info, published 29 Oct 2026) - [CVE-2026-113690: BMC IT Service Management Suite stored XSS in attachment feature](https://junglewise.ai/threats/cve-2026-113690-stored-cross-site-scripting-in-the-smartit-attachment-feature-of) (info, published 29 Oct 2026) - [CVE-2026-113688: BMC IT Service Management Suite SSRF in URL-based attachment feature](https://junglewise.ai/threats/cve-2026-113688-server-side-request-forgery-in-the-smartit-url-based-attachment) (info, published 29 Oct 2026) - [CVE-2026-10537: BMC Control-M misconfiguration allows unauthenticated access](https://junglewise.ai/threats/cve-2026-10537-a-misconfiguration-issue-in-the-affected-service-in-control-m) (medium, CVSS 5.3, published 27 Oct 2026) - [CVE-2026-111283: BMC Helix Network Management authentication bypass in SAML](https://junglewise.ai/threats/cve-2026-111283-bmc-helix-network-management-on-prem-before-26-3-01-contains-an) (critical, CVSS 9, published 15 Oct 2026) - [CVE-2026-23781: BMC Control-M/MFT hardcoded credentials in debug interface](https://junglewise.ai/threats/cve-2026-23781-bmc-control-m-mft-hardcoded-credentials-in-debug-interface) (critical, CVSS 9.8, published 10 Apr 2026) - [CVE-2026-23782: BMC Control-M/MFT information disclosure in API management endpoint](https://junglewise.ai/threats/cve-2026-23782-bmc-control-m-mft-information-disclosure-in-api-management) (high, CVSS 7.5, published 10 Apr 2026) - [CVE-2026-23780: BMC Control-M/MFT SQL injection in MFT API debug interface](https://junglewise.ai/threats/cve-2026-23780-bmc-control-m-mft-sql-injection-in-mft-api-debug-interface) (high, CVSS 8.8, published 10 Apr 2026) - [CVE-2025-71260: BMC FootPrints ITSM deserialization of untrusted data in VIEWSTATE](https://junglewise.ai/threats/cve-2025-71260-bmc-footprints-itsm-deserialization-of-untrusted-data-in) (high, CVSS 8.8, published 19 Mar 2026) - [CVE-2025-71259: BMC FootPrints ITSM server-side request forgery in externalfeed/RSS](https://junglewise.ai/threats/cve-2025-71259-bmc-footprints-itsm-server-side-request-forgery-in-externalfeed) (medium, CVSS 4.3, published 19 Mar 2026) - [CVE-2025-71258: BMC FootPrints ITSM blind server-side request forgery in searchWeb API](https://junglewise.ai/threats/cve-2025-71258-bmc-footprints-itsm-blind-server-side-request-forgery-in) (medium, CVSS 4.3, published 19 Mar 2026) - [CVE-2025-71257: BMC FootPrints ITSM authentication bypass in REST API](https://junglewise.ai/threats/cve-2025-71257-bmc-footprints-itsm-authentication-bypass-in-rest-api) (high, CVSS 7.3, published 19 Mar 2026) ## Most severe Bmc vulnerabilities - [CVE-2026-23781: BMC Control-M/MFT hardcoded credentials in debug interface](https://junglewise.ai/threats/cve-2026-23781-bmc-control-m-mft-hardcoded-credentials-in-debug-interface) (critical, CVSS 9.8, published 10 Apr 2026) - [CVE-2026-111283: BMC Helix Network Management authentication bypass in SAML](https://junglewise.ai/threats/cve-2026-111283-bmc-helix-network-management-on-prem-before-26-3-01-contains-an) (critical, CVSS 9, published 15 Oct 2026) - [CVE-2025-71260: BMC FootPrints ITSM deserialization of untrusted data in VIEWSTATE](https://junglewise.ai/threats/cve-2025-71260-bmc-footprints-itsm-deserialization-of-untrusted-data-in) (high, CVSS 8.8, published 19 Mar 2026) - [CVE-2026-23780: BMC Control-M/MFT SQL injection in MFT API debug interface](https://junglewise.ai/threats/cve-2026-23780-bmc-control-m-mft-sql-injection-in-mft-api-debug-interface) (high, CVSS 8.8, published 10 Apr 2026) - [CVE-2026-23782: BMC Control-M/MFT information disclosure in API management endpoint](https://junglewise.ai/threats/cve-2026-23782-bmc-control-m-mft-information-disclosure-in-api-management) (high, CVSS 7.5, published 10 Apr 2026) - [CVE-2025-71257: BMC FootPrints ITSM authentication bypass in REST API](https://junglewise.ai/threats/cve-2025-71257-bmc-footprints-itsm-authentication-bypass-in-rest-api) (high, CVSS 7.3, published 19 Mar 2026) - [CVE-2026-10537: BMC Control-M misconfiguration allows unauthenticated access](https://junglewise.ai/threats/cve-2026-10537-a-misconfiguration-issue-in-the-affected-service-in-control-m) (medium, CVSS 5.3, published 27 Oct 2026) - [CVE-2025-71258: BMC FootPrints ITSM blind server-side request forgery in searchWeb API](https://junglewise.ai/threats/cve-2025-71258-bmc-footprints-itsm-blind-server-side-request-forgery-in) (medium, CVSS 4.3, published 19 Mar 2026) - [CVE-2025-71259: BMC FootPrints ITSM server-side request forgery in externalfeed/RSS](https://junglewise.ai/threats/cve-2025-71259-bmc-footprints-itsm-server-side-request-forgery-in-externalfeed) (medium, CVSS 4.3, published 19 Mar 2026) - [CVE-2026-113697: BMC Helix Operations Management reflected XSS in agent query](https://junglewise.ai/threats/cve-2026-113697-reflected-cross-site-scripting-in-the-agent-query-feature-of-bmc) (info, published 29 Oct 2026) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 10 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Bmc technologies - [Bmc IT Service Management Suite](https://junglewise.ai/threats/technologies/bmc-it-service-management-suite): 8 vulnerabilities - [Bmc Footprints](https://junglewise.ai/threats/technologies/footprints): 4 vulnerabilities - [Bmc FootPrints ITSM](https://junglewise.ai/threats/technologies/footprints-itsm): 4 vulnerabilities - [Bmc Control-M\](https://junglewise.ai/threats/technologies/control-m): 3 vulnerabilities - [Bmc Managed File Transfer](https://junglewise.ai/threats/technologies/managed-file-transfer): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Bmc vulnerabilities", https://junglewise.ai/threats/vendors/bmc, 9 November 2026.