Which versions of BMC Control-M are affected by CVE-2026-10538?

BMC Control-M/Server and Enterprise Manager versions 9.0.20.x and earlier contain a high-severity server-side object injection vulnerability (CVSS 8.9) exploitable by authenticated administrators to…. A patch is available.

How to fix or mitigate CVE-2026-10538?

Within 24 hours: Inventory all Control-M/Server and Enterprise Manager deployments; document version numbers and identify instances running 9.0.20.x or earlier; audit administrative account activity logs for the past 90 days. Within 7 days: Contact BMC for supported upgrade versions and patch availability; assess production dependency on affected versions; develop upgrade or remediation timeline. Within 30 days: Execute upgrade to the latest supported Control-M release with vendor-released patches, or deploy and validate all compensating controls if upgrade timeline extends beyond day 30.

BMC Control-M CVE-2026-10538

Q: What is the CVSS score of CVE-2026-10538?

CVE-2026-10538 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40926 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-01 airbus

GHSA-w883-5vxm-2pq9

Deserialization Control M Server Bmc Control M Enterprise Manager

8.9

CVSS 4.0 · Vendor: airbus

Severity by source

Vendor (airbus) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Network-reachable messaging consumer (AV:N) but needs a privileged account (PR:H) and a non-trivial gadget chain (AC:H); deserialization impacts downstream components so S:C with full C/I/A loss.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (airbus).

CVSS VectorVendor: airbus

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 09:01 EUVD

Analysis Generated

Jul 01, 2026 - 08:34 vuln.today

DescriptionCVE.org

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

AnalysisAI

Server-side object injection in BMC Control-M/Server and Control-M/Enterprise Manager 9.0.20.x (and potentially earlier) lets an authenticated attacker abuse the messaging consumer to deserialize untrusted, type-unrestricted objects, triggering unintended server-side behavior that can escalate to full compromise of the automation server. The affected releases are already out of support, and the CVSS 4.0 base score is 8.9 (High) with high privileges and high attack complexity required. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Control-M is BMC's enterprise workload automation (job scheduling) platform; Control-M/Server orchestrates and executes jobs while Control-M/Enterprise Manager provides the central management console. The flaw is a CWE-502 Deserialization of Untrusted Data weakness: the messaging consumer component accepts serialized objects from a client/message channel and reconstructs them without restricting which object types (classes) may be instantiated. When a deserialization runtime is allowed to build arbitrary gadget-chain objects from attacker-controlled bytes, method side effects during construction/resolution can be chained into unintended logic or code execution. The affected CPEs are cpe:2.3:a:bmc:control-m/enterprise_manager and cpe:2.3:a:bmc:control-m/server, both at 9.0.20.x and earlier.

RemediationAI

Because the impacted 9.0.20.x branch is out of support, the primary remediation is to upgrade Control-M/Server and Control-M/Enterprise Manager to a current, vendor-supported major release that is not affected, following the vendor knowledge article at https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000GFKrCAO&type=Solution (no exact fixed 9.0.20.x version was provided in the input, so treat this as an upgrade-off-EOL action rather than an in-branch patch). As compensating controls until upgrade, restrict network reachability of the Control-M messaging/consumer ports so only trusted management hosts can connect (side effect: agents or integrations using those channels must be explicitly allow-listed or they will lose connectivity), tightly limit and monitor the high-privilege accounts that could reach the messaging consumer since exploitation requires PR:H, and enable enhanced logging/alerting on the messaging component to detect anomalous serialized payloads. Do not rely on generic hardening alone; validate any mitigation against BMC's advisory as the out-of-support status means no in-branch security fix should be assumed.