PT-2026-54506 · Bmc · Control-M/Server

Jean-Romain Garnier + 1 · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-10539

Mitre

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. 

This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2026-10539

Affected Products

Control-M/Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-10539 · Security Note
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000GFZNCA4&type=Solution · Note