What’s Vulnerable › Products

BMC Control-M/Server vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your BMC Control-M/Server version is affected

Latest BMC Control-M/Server vulnerabilities

• CVE-2026-10537 — Remote unauthenticated information disclosure and denial of service due to unauthenticated service access (CVSS 5.3)
• CVE-2026-10539 — Unauthenticated command injection in Control-M/Server communication command (CVSS 9.0)
• CVE-2026-10538 — Improper deserialization handling in Control-M Components (CVSS 8.0)
• CVE-2025-48709 — BMC Control-M/Server cleartext database credentials in process lists and logs (CVSS 7.8)