Authentication Bypass in Control-M/Agent by BMC Software
CVE-2025-55109

9.5CRITICAL

Key Information:

Vendor

Bmc

Status
Control-m/agent
Vendor
CVE Published:
16 September 2025

What is CVE-2025-55109?

An authentication bypass vulnerability in the Control-M/Agent allows remote attackers to circumvent authentication processes when using empty or default keystores. This issue is especially concerning for users of unsupported versions 9.0.18 to 9.0.20, where expired fallback certificates may inadvertently trust unauthorized entities. By leveraging a null or default PKCS#12 keystore, attackers can exploit the hardcoded certificates included in these versions, leading to potential unauthorized access. It's critical for users to be aware of the trusted certificates that could expose client authentication processes to exploitation.

Affected Version(s)

Control-M/Agent 9.0.21

Control-M/Agent 9.0.20

Control-M/Agent 9.0.19

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
vendor-advisory
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
mitigation

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Airbus SAS - Jean-Romain Garnier - [email protected]
.
CVE-2025-55109 : Authentication Bypass in Control-M/Agent by BMC Software