Path Traversal Vulnerability in Control-M/Agent by BMC Software
CVE-2025-55115

9.3CRITICAL

Key Information:

Vendor

Bmc

Status
Control-m/agent
Vendor
CVE Published:
16 September 2025

What is CVE-2025-55115?

A path traversal vulnerability exists in Control-M/Agent that allows attackers with system access to exploit the software, potentially escalating their privileges. The issue affects out-of-support versions 9.0.18 to 9.0.20 and possibly earlier versions. Users are advised to upgrade to version 9.0.20.100 or later to mitigate this vulnerability.

Affected Version(s)

Control-M/Agent 9.0.21

Control-M/Agent 9.0.20

Control-M/Agent 9.0.19

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
vendor-advisory
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
mitigation

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Airbus SAS - Jean-Romain Garnier - [email protected]
.
CVE-2025-55115 : Path Traversal Vulnerability in Control-M/Agent by BMC Software