Control-M Enterprise Manager CVE-2026-10540

Exploitation requires local access to the Control-M/Enterprise Manager server with high operating-system or application privileges (PR:H per CVSS 4.0) sufficient to read the credential store - this is not a remotely triggerable flaw. The attack condition AT:P further requires that the attacker successfully exfiltrate the hash data before any offline cracking is possible. The vulnerability is limited to unsupported versions 9.0.20.x and potentially earlier; organizations running current supported BMC Control-M releases are not listed as affected. There is no network-facing exploitation path, no user interaction component, and no lateral effect on subsequent systems (SC:N/SI:N/SA:N). What limits exploitation: the requirement for pre-existing high-privilege local access means this is a post-compromise technique, not an initial access vector; the unsupported-version constraint further reduces the realistic exposed population.

The CVSS 4.0 score of 5.6 (Medium) appropriately reflects the constrained exploitation path: AV:L restricts initial access to local or adjacent systems, PR:H requires admin-level credentials to reach the credential store, and AT:P signals that specific attack conditions - namely, successful exfiltration of hash data - must be met before the weakness is exercisable. These three factors together mean this vulnerability is a post-compromise amplifier, not an initial access vector. There is no CISA KEV listing and no reported public proof-of-concept, so exploitation is limited to threat actors who have already deeply compromised the environment. EPSS data was not provided, but given the privilege and access prerequisites, real-world exploitation probability is assessed as low. Critically, affected versions (9.0.20.x and earlier) are officially unsupported by BMC, which both reduces the installed base still running them and eliminates the possibility of a vendor hotfix - organizations that have not upgraded face permanent exposure for these versions. The primary real-world risk is credential reuse: if Control-M admin passwords recovered offline match credentials used elsewhere in the enterprise, the blast radius expands significantly.

An attacker who has already escalated to administrator-level access on the Control-M/Enterprise Manager host - whether through a separate vulnerability, phishing, or insider threat - extracts the application's credential store from the local filesystem. Using a GPU-accelerated offline cracking tool against the weakly-hashed entries, the attacker recovers plaintext passwords for Control-M accounts and leverages any credential reuse to pivot into other enterprise systems or escalate further. No public proof-of-concept has been identified, but the technique requires only standard offline cracking tooling once hash data is obtained.