Vulnerability · Published Jul 1, 2026 · Assigned by airbus
CVE-2026-10539Unauthenticated command injection in Control-M/Server communication command
Critical 9.0
In plain English
A critical-severity security flaw in Control-M/Server from BMC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BMC | Control-M/Server | 9.0.20 – through 9.0.21.200 |
Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H