CVE-2026-10539criticalCWE-305

CVE-2026-10539: falha crítica em BMC Control-M/Server

Unauthenticated command injection in Control-M/Server communication command

Publicada em

Seguir esta CVE+ Monitorar Control-M/Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.5epss 0.4%
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server.  This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
BMC · Control-M/Server
CVEs relacionadas — BMC Control-M/Server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-10538HIGHImproper deserialization handling in Control-M ComponentsEPSS 0.4%CVE-2026-10537MEDIUMRemote unauthenticated information disclosure and denial of service due to unauthenticated service accessEPSS 0.3%CVE-2025-48709MEDIUMBMC Control-M/Server cleartext database credentials in process lists and logsEPSS 0.1%