CVE-2026-10539criticalCWE-305

CVE-2026-10539: critical vulnerability in BMC Control-M/Server

Unauthenticated command injection in Control-M/Server communication command

Published

Follow this CVE+ Monitor Control-M/Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.5epss 0.4%
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server.  This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
BMC · Control-M/Server
Related CVEs — BMC Control-M/Server

In the same product, most dangerous first.

CVE-2026-10538HIGHImproper deserialization handling in Control-M ComponentsEPSS 0.4%CVE-2026-10537MEDIUMRemote unauthenticated information disclosure and denial of service due to unauthenticated service accessEPSS 0.3%CVE-2025-48709MEDIUMBMC Control-M/Server cleartext database credentials in process lists and logsEPSS 0.1%