What’s Vulnerable › Vulnerabilities

CVE-2025-55108: BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-05 · updated 2026-10-18
• Weakness: CWE-306

Description

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE:  * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS

Affected products

• BMC Control-M/Agent: 9.0.22, 9.0.21, 9.0.20, 9.0.19, 9.0.18

References

• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271

Get alerted when CVE-2025-55108 or the next vulnerability affects your stack