Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-10537 EUVD-2026-110856

Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

Published Oct 27, 2026 · Updated Nov 4, 2026 · Assigned by airbus

Description

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.

This vulnerability affects :

* Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.
* Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

Affected products

VendorProductAffectedFixed
BMC Control-M/Enterprise Manager 9.0.20 – < 9.0.22 9.0.22
BMC Control-M/Server 9.0.20 – < 9.0.22 9.0.22

References