Skip to content
OpenAdvisories

Vendor

BMC

34 known vulnerabilities.

Products

Control-M/Agent 11 BMC IT Service Management Suite 9 Track-It! 5 Control-M/Server 4 Control-M/Enterprise Manager 3 Control-M 3 BMC Helix Operations Management 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.0
    CVE-2026-10538

    Improper deserialization handling in Control-M Components

    Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issu…

    BMC Control-M/Server Control-M/Enterprise Manager
  • High 8.9
    CVE-2025-55118

    BMC Control-M/Agent memory corruption in SSL/TLS communication

    Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control…

    BMC Control-M/Agent
  • High 8.8
    CVE-2025-55116

    BMC Control-M/Agent buffer overflow local privilege escalation

    A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsu…

    BMC Control-M/Agent
  • High 8.8
    CVE-2025-55115

    BMC Control-M/Agent path traversal local privilege escalation

    A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsup…

    BMC Control-M/Agent
  • High 7.4
    CVE-2025-55112

    BMC Control-M/Agent hardcoded Blowfish keys

    Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key …

    BMC Control-M/Agent
  • High 8.8
    CVE-2021-35002

    BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability

    BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific…

    BMC Track-It!
  • High 7.3
    CVE-2022-35865

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2…

    BMC Track-It!