CVE-2026-10539criticalCWE-305

CVE-2026-10539: fallo crítico en BMC Control-M/Server

Unauthenticated command injection in Control-M/Server communication command

Publicada el

Seguir esta CVE+ Monitorear Control-M/Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.5epss 0.4%
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server.  This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
BMC · Control-M/Server
CVEs relacionadas — BMC Control-M/Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-10538HIGHImproper deserialization handling in Control-M ComponentsEPSS 0.4%CVE-2026-10537MEDIUMRemote unauthenticated information disclosure and denial of service due to unauthenticated service accessEPSS 0.3%CVE-2025-48709MEDIUMBMC Control-M/Server cleartext database credentials in process lists and logsEPSS 0.1%