Follow these instructions if you are a BMC Helix customer

Customers should report suspected vulnerabilities through their existing BMC Helix support channels. Using established support processes helps ensure the report is prioritized and investigated within the appropriate customer context.

To expedite handling of the vulnerability, please include:

• Your name, email, and phone number
• BMC Helix product name (For example, TrueSight Server Automation)
• BMC Helix product version (preferably the full version and patch level. For example, v.9.8.01 SP1)
• Detailed description of the vulnerability with steps to reproduce its discovery
• Detailed steps to exploit the vulnerability (if available)
• Applicable CVEs, hostnames, and IP addresses (for vulnerabilities related to infrastructure)

Follow these instructions if you are an external researcher or other role

To report a security issue related to a BMC Helix website or hosted service, please contact our IT security team at security-disclosure@helixops.ai. To report a security issue related to a BMC Helix product, please contact our Product Security Group at appsec@helixops.ai.

To expedite handling of the vulnerability please include:

• Your name, email, and phone number
• BMC Helix product name (For example, TrueSight Server Automation)
• BMC Helix product version (preferably the full version and patch level. For example, v.9.8.01 SP1)
• Detailed description of the vulnerability with steps to reproduce its discovery
• Detailed steps to exploit the vulnerability (if available)
• Applicable CVEs, hostnames, and IP addresses (for vulnerabilities related to infrastructure)

If the content of your communication is sensitive, please download our PGP key to encrypt your email. The PGP fingerprint is: 70FB 585C A44D 0E55 8640 7DA5 C430 2F26 0B50 43BF

If you do not trust the integrity of this website, please email us at appsec@helixops.ai with a phone number where we can reach you to provide the fingerprint verbally.