Vulnerability · Published Oct 27, 2026 · Assigned by airbus
CVE-2026-10537Remote unauthenticated information disclosure and denial of service due to unauthenticated service access
Medium 5.3
In plain English
A medium-severity security flaw in Control-M/Enterprise Manager from BMC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BMC | Control-M/Enterprise Manager | 9.0.20 – before 9.0.22 |
| BMC | Control-M/Server | 9.0.20 – before 9.0.22 |
Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N