{"schema":"threatline.record/2","record":{"id":"CVE-2026-10537","aliases":[],"summary":"Remote unauthenticated information disclosure and denial of service due to unauthenticated service access","details":"A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.\n\n\n\n\nThis vulnerability affects :\n\n  *  Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.\n  *  Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions","categories":["Unclassified"],"product":"Control-M/Enterprise Manager","vendor":"BMC","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-10537","source_modified_at":"2026-10-27T13:26:13.078Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"Control-M/Enterprise Manager","vendor":"BMC","versions":[{"status":"unaffected","version":"9.0.22","versionType":"semver"},{"status":"affected","version":"9.0.20","lessThan":"9.0.22","versionType":"semver"}],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-10537","source_modified_at":"2026-10-27T13:26:13.078Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"Control-M/Server","vendor":"BMC","versions":[{"status":"unaffected","version":"9.0.22","versionType":"semver"},{"status":"affected","version":"9.0.20","lessThan":"9.0.22","versionType":"semver"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-10537","source_modified_at":"2026-10-27T13:26:13.078Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"Control-M/Enterprise Manager","ecosystem":null},"version":"9.0.22","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-10537","source_modified_at":"2026-10-27T13:26:13.078Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"Control-M/Server","ecosystem":null},"version":"9.0.22","basis":"first unaffected version stated in the CVE record"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T13:26:13.078Z","modified_at":"2026-10-27T13:26:13.078Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-10537","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:26:13.078Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000KMUDCA4&type=Solution"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T13:26:13.078Z","content_hash":"1eea3a10549c982d19f3161abfdd38007c460e02e0a127cc6c3ac8341cafd2e9"}}