Access Control Bypass in Control-M/Agent by BMC Software
CVE-2025-55113
What is CVE-2025-55113?
A vulnerability exists in the Control-M/Agent where the Access Control List (ACL) enforcement can be bypassed if the C router is in use. This issue primarily affects earlier versions of Control-M/Agent, such as 9.0.18 to 9.0.20, or even earlier unsupported versions. When a client certificate's email address contains a NULL byte, the verification process terminates prematurely, allowing an attacker to exploit this flaw by presenting a specially crafted certificate to bypass the defined ACLs.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Control-M/Agent 9.0.22.000
Control-M/Agent 9.0.22.000
Control-M/Agent 9.0.21
References
CVSS V4
Timeline
Vulnerability published
Vulnerability Reserved
