PT-2026-31922 · Bmc · Bmc Control-M/Mft

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-23782

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BMC Control-M/MFT versions 9.0.20 through 9.0.22

Description An API management endpoint allows unauthenticated users to obtain an API identifier and its corresponding secret value. An attacker could use these exposed secrets to invoke privileged API operations, potentially leading to unauthorized access.

Recommendations Update to a version later than 9.0.22.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-23782

Affected Products

Bmc Control-M/Mft

References · 4

• https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-308/?srid=ab0apVT3 · Patch
• https://bmc.com/support/resources/issue-defect-management.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23782 · Security Note
• https://twitter.com/VulmonFeeds/status/2042689810502922546 · Twitter Post