CVE-2025-48709: medium-severity vulnerability in BMC Control-M/Server
BMC Control-M/Server cleartext database credentials in process lists and logs
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.1%
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
BMC · Control-M/ServerRelated CVEs — BMC Control-M/Server
In the same product, most dangerous first.
CVE-2026-10539CRITICALUnauthenticated command injection in Control-M/Server communication commandEPSS 0.4%CVE-2026-10538HIGHImproper deserialization handling in Control-M ComponentsEPSS 0.4%CVE-2026-10537MEDIUMRemote unauthenticated information disclosure and denial of service due to unauthenticated service accessEPSS 0.3%