All vulnerabilities
CVE-2026-10537

Control-M/Enterprise Manager: Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

BMC Control-M/Enterprise Manager
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in9.0.22Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.

This vulnerability affects :

  • Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.
  • Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

Text from CVE List

Affected versions 4

  • Control-M/Enterprise Managerunaffected: 9.0.22CVE List
  • Control-M/Enterprise Manageraffected: 9.0.20 before 9.0.22CVE List
  • Control-M/Serverunaffected: 9.0.22CVE List
  • Control-M/Serveraffected: 9.0.20 before 9.0.22CVE List

References 1