Control-M/Server vulnerabilities

3 known vulnerabilities in Control-M/Server from BMC. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  Control-M/Server: Authentication Bypass by Primary Weakness

  CVE-2026-10539Jul 1, 2026BMC

  A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to co

• 8.0 High severity

  Control-M/Enterprise Manager: Deserialization of Untrusted Data

  CVE-2026-10538Jul 1, 2026BMC

  Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue

• 7.8 High severity

  Control-M/Server: Insufficiently Protected Credentials

  CVE-2025-48709Aug 7, 2025BMC

  BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on