CVE-2026-10537

EUVD-2026-110856

27.10.2026, 14:16

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.




This vulnerability affects :

  *  Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.
  *  Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
airbus	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
bmc	control-m	9.0.20 ≤ 𝑥 < 9.0.22	CNA

Common Weakness Enumeration

CWE-305 - Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000KMUDCA4&type=Solution