CVE-2026-10539
PUBLISHED
Published: 01 Jul 2026, 07:55
Last modified:01 Jul 2026, 07:55
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.5 CRITICAL
v4.0 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
01 Jul 2026, 07:55
Published
Vulnerability first disclosed
Description
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.
CVSS Metrics
- v4.0•CRITICAL•Score: 9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- v3.1•CRITICAL•Score: 9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Techniques & Countermeasures
- CWE-305•Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Affected Systems
- bmc•control-m/server
≥ 9.0.20, ≤ 9.0.21.200