What’s Vulnerable › Vulnerabilities

CVE-2025-55110: BMC Control-M/Agent hardcoded default keystore password

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-16 · updated 2026-06-17
• Weakness: CWE-1392

Description

Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data using this password.

Affected products

• BMC Control-M/Agent: 9.0.22, 9.0.21, 9.0.20, 9.0.19, 9.0.18

References

• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441964
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099

Get alerted when CVE-2025-55110 or the next vulnerability affects your stack