What’s Vulnerable › Vulnerabilities

CVE-2025-55112: BMC Control-M/Agent hardcoded Blowfish keys

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-16 · updated 2026-06-17
• Weakness: CWE-321

Description

Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key could decrypt network traffic between the Control-M/Agent and Server.

Affected products

• BMC Control-M/Agent: through 9.0.20.200

References

• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441966
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099

Get alerted when CVE-2025-55112 or the next vulnerability affects your stack