BMC vulnerabilities
We track 19 vulnerabilities in BMC products across 8 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest BMC vulnerabilities
- 9.0 Critical severity
Control-M/Server: Authentication Bypass by Primary Weakness
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to co
- 8.0 High severity
Control-M/Enterprise Manager: Deserialization of Untrusted Data
Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue
- 9.8 Critical severity
Control-m/managed File Transfer: Use of Hard-coded Credentials
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access
- 7.5 High severity
Control-m/managed File Transfer: Improper Access Control
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API
- 8.8 High severity
Control-m/managed File Transfer: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Su
- 10.0 Critical severity
Control-M/Agent: Missing Authentication for Critical Functionality
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE: * The vendor believes that t
- 8.9 High severity
Control-M/Agent: Heap-based Buffer Overflow
Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-
- 8.8 High severity
Control-M/Agent: Stack-based Buffer Overflow
A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsup
- 8.8 High severity
Control-M/Agent: Relative Path Traversal
A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupp
- 10.0 Critical severity
Control-M/Agent: Improper Neutralization of Null Byte or NUL Character
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting i
- 7.4 High severity
Control-M/Agent: Use of Hard-coded Cryptographic Key
Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key c
- 9.0 Critical severity
Control-M/Agent: Improper Certificate Validation
An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS#12 keystore. A remote attacker with access
- 7.8 High severity
Control-M/Server: Insufficiently Protected Credentials
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on
- 9.8 Critical severity
remedy_mid-tier: Improper Authentication
**UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker is able to access any user account without using any password. NOTE: This vulnerability only affects products that are no longer supported b
- 7.8 High severity
Control-M: Incorrect Default Permissions
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with th
- 9.8 Critical severity
Control-m: Improper Neutralization of Special Elements used in an SQL Command
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).
- 7.5 High severity
Patrol: Missing Encryption of Sensitive Data
An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution.
- 9.8 Critical severity
Track-It!: Missing Authentication for Critical Functionality
This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The i
- 9.8 Critical severity
Track-It!: Improper Authentication
This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The i