CVE-2026-10538highCWE-502

CVE-2026-10538: falha de alta gravidade em BMC Control-M/Server

Improper deserialization handling in Control-M Components

Publicada em

Seguir esta CVE+ Monitorar Control-M/Server+ Monitorar Control-M/Enterprise Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.9epss 0.4%
Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
BMC · Control-M/Enterprise ManagerBMC · Control-M/Server
CVEs relacionadas — BMC Control-M/Server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-10539CRITICALUnauthenticated command injection in Control-M/Server communication commandEPSS 0.4%CVE-2026-10537MEDIUMRemote unauthenticated information disclosure and denial of service due to unauthenticated service accessEPSS 0.3%CVE-2025-48709MEDIUMBMC Control-M/Server cleartext database credentials in process lists and logsEPSS 0.1%CVE-2026-10540MEDIUMWeak password hash protection in Control-M/Entreprise ManagerEPSS 0.1%