Skip to content
OpenAdvisories

Product · BMC

Control-M/Server

4 known vulnerabilities.

Control-M/Server at a glance

Last 12 months
3
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 2 vulnerabilities, 1 critical August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202621
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.3
    CVE-2026-10537

    Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

    A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service avai…

    BMC Control-M/Server Control-M/Enterprise Manager
  • High 8.0
    CVE-2026-10538

    Improper deserialization handling in Control-M Components

    Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issu…

    BMC Control-M/Server Control-M/Enterprise Manager
  • Critical 9.0
    CVE-2026-10539

    Unauthenticated command injection in Control-M/Server communication command

    A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to c…

    BMC Control-M/Server
  • Low 3.8
    CVE-2025-48709

    BMC Control-M/Server cleartext database credentials in process lists and logs

    BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on…

    BMC Control-M/Server