CVE-2026-10537mediumCWE-305

CVE-2026-10537: falha de média gravidade em BMC Control-M/Enterprise Manager

Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Control-M/Server+ Monitorar Control-M/Enterprise Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
BMC · Control-M/Enterprise ManagerBMC · Control-M/Server
CVEs relacionadas — BMC Control-M/Enterprise Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2026-10539CRITICALUnauthenticated command injection in Control-M/Server communication commandEPSS 0.4%CVE-2026-10538HIGHImproper deserialization handling in Control-M ComponentsEPSS 0.4%CVE-2025-48709MEDIUMBMC Control-M/Server cleartext database credentials in process lists and logsEPSS 0.1%CVE-2026-10540MEDIUMWeak password hash protection in Control-M/Entreprise ManagerEPSS 0.1%