Log in Start free

BMC

Products

ProductCVEsExploitedLatest
Control-M/Agent11–Nov 5, 2025
BMC IT Service Management Suite9–Oct 29, 2026
Track-It!5–May 7, 2024
Control-M/Server4–Oct 27, 2026
Control-M3–Mar 18, 2024
Control-M/Enterprise Manager3–Oct 27, 2026
BMC Helix Operations Management1–Oct 29, 2026

Exploited and recent CVEs

  • CVE-2026-113697 Medium 4.8 Reflected Cross-Site Scripting in BMC Helix Operations Management 0.4%
  • CVE-2026-113696 Medium 5.3 Improper Authorization in BMC ITSM SmartIT Change Approvals 0.4%
  • CVE-2026-113695 Medium 4.8 Reflected Cross-Site Scripting in BMC ITSM SmartIT 0.3%
  • CVE-2026-113694 Medium 5.3 Improper Authorization in BMC ITSM SmartIT Attachments 0.3%
  • CVE-2026-113693 Medium 5.3 System Account Credential Disclosure in BMC ITSM 0.3%
  • CVE-2026-113692 Medium 6.9 Path Traversal in BMC ITSM 0.5%
  • CVE-2026-113691 Medium 5.1 Stored Cross-Site Scripting in BMC ITSM Knowledge Articles 0.4%
  • CVE-2026-113690 Medium 4.8 Stored Cross-Site Scripting in BMC ITSM Attachments 0.3%
  • CVE-2026-113689 Medium 5.1 Stored Cross-Site Scripting in BMC ITSM Work Notes 0.3%
  • CVE-2026-113688 Medium 5.3 Server-Side Request Forgery in BMC ITSM SmartIT 0.3%
  • CVE-2026-10537 Medium 5.3 Remote unauthenticated information disclosure and denial of service due to unauthenticated service access 0.3%
  • CVE-2026-10537 Medium 5.3 Remote unauthenticated information disclosure and denial of service due to unauthenticated service access 0.3%
  • CVE-2026-10538 High 8.0 Improper deserialization handling in Control-M Components 0.4%
  • CVE-2026-10538 High 8.0 Improper deserialization handling in Control-M Components 0.4%
  • CVE-2026-10539 Critical 9.0 Unauthenticated command injection in Control-M/Server communication command 0.4%
  • CVE-2026-10540 Medium 5.6 Weak password hash protection in Control-M/Entreprise Manager 0.1%
  • CVE-2025-55108 Critical 10.0 BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution 0.8%
  • CVE-2025-55118 High 8.9 BMC Control-M/Agent memory corruption in SSL/TLS communication 0.4%
  • CVE-2025-55117 Medium 5.3 BMC Control-M/Agent buffer overflow in SSL/TLS communication 0.3%
  • CVE-2025-55116 High 8.8 BMC Control-M/Agent buffer overflow local privilege escalation 0.2%
  • CVE-2025-55115 High 8.8 BMC Control-M/Agent path traversal local privilege escalation 0.2%
  • CVE-2025-55114 Medium 5.3 BMC Control-M/Agent improper IP address filtering order 0.4%
  • CVE-2025-55113 Critical 9.0 BMC Control-M/Agent unescaped NULL byte in access control list checks 0.3%
  • CVE-2025-55112 High 7.4 BMC Control-M/Agent hardcoded Blowfish keys 0.2%
  • CVE-2025-55111 Medium 5.5 BMC Control-M/Agent insecure default file permissions 0.1%
  • CVE-2025-55110 Medium 5.5 BMC Control-M/Agent hardcoded default keystore password 0.1%
  • CVE-2025-55109 Critical 9.0 BMC Control-M/Agent default SSL/TLS configuration authenticated bypass 0.4%
  • CVE-2025-48709 Low 3.8 BMC Control-M/Server cleartext database credentials in process lists and logs 0.1%
  • CVE-2021-35002 High 8.8 BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability 1.7%
  • CVE-2021-35001 Low 3.1 BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability 0.8%