Misconfiguration Vulnerability in Control-M by BMC Software
CVE-2026-10537

6.9MEDIUM

Key Information:

Vendor

Bmc

Status
Control-m/enterprise Manager
Control-m/server
Vendor
CVE Published:
27 October 2026

What is CVE-2026-10537?

A misconfiguration in BMC's Control-M/Enterprise Manager and Control-M/Server could permit unauthenticated remote users to gain access to sensitive functionalities. This unauthorized access raises concerns over potential information exposure and may disrupt service availability. Organizations using versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions should take appropriate precautions to mitigate these risks.

Affected Version(s)

Control-M/Enterprise Manager 9.0.22

Control-M/Enterprise Manager 9.0.20 < 9.0.22

Control-M/Server 9.0.22

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jean-Romain Garnier from [Airbus Security Lab](https://airbus-seclab.github.io) - <vuln@airbus.com>
Quentin Liddell from [Airbus Security Lab](https://airbus-seclab.github.io) - <vuln@airbus.com>
.