BMC Control-M CVE-2026-10537

An exposed, network-reachable Control-M/Enterprise Manager or Control-M/Server instance running an affected version (9.0.20 up to but excluding 9.0.22, and potentially earlier unsupported versions) in a configuration where the affected service permits unauthenticated access. Per CVSS PR:N/UI:N, no credentials or user interaction are required once the service is reachable. The exact service feature, protocol, or configuration setting that must be present is not described in the available sources, so the primary limiting factor is network exposure of the affected Control-M service to untrusted clients; instances isolated behind segmentation or access controls are correspondingly harder to reach. Impact is bounded to Low confidentiality/integrity/availability with no scope change, limiting the practical consequence to partial information exposure or partial service disruption rather than full compromise.

This is a medium-severity issue (CVSS 4.0 base 6.9) whose signals are internally consistent but modest. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which raises its accessibility, but the impact metrics are uniformly Low (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N), bounding the damage to partial information exposure and partial availability effects against the service itself. Exploitation status: no public exploit identified at time of analysis - the single reference is a BMC vendor knowledge/solution article, not a PoC, and there is no CISA KEV listing. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this input. The vuln.today decision label is 'this_month', consistent with a patch-available, moderate-impact issue that warrants scheduled remediation rather than emergency action. Net: a genuine but non-emergency unauthenticated exposure - prioritize patching within normal cycles, weighted by how exposed the affected Control-M services are to untrusted networks. Note the description is vague about which service function is exposed, so the real-world blast radius should be confirmed with BMC.

A remote attacker with network reachability to an exposed Control-M/Enterprise Manager or Control-M/Server instance (versions 9.0.20 to below 9.0.22) sends requests to a misconfigured service endpoint that is reachable without authentication, gaining access to certain service functionality. This could yield limited information disclosure or degrade availability of the scheduling service. No public exploit code is identified at time of analysis, and the precise trigger is not described in the available sources.