Is there a patch available for CVE-2026-10540?

Yes, a patch is available for CVE-2026-10540. Update the affected software to the latest version immediately.

Control-M Enterprise Manager CVE-2026-10540

Q: What is the CVSS score of CVE-2026-10540?

CVE-2026-10540 has a CVSS 4.0 base score of 5.6 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-40933 MEDIUM

Use of Weak Hash (CWE-328)

2026-07-01 airbus

GHSA-7fxm-rp47-f3xm

Information Disclosure Bmc Control M Enterprise Manager

5.6

CVSS 4.0 · Vendor: airbus

Severity by source

Vendor (airbus) PRIMARY

5.6 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local vector and high privileges required to access credential store; confidentiality-only impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (airbus).

CVSS VectorVendor: airbus

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 09:01 EUVD

Analysis Generated

Jul 01, 2026 - 08:35 vuln.today

DescriptionCVE.org

The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions

AnalysisAI

Weak password hash storage in BMC Control-M/Enterprise Manager exposes account credentials to offline recovery attacks if an attacker gains access to the credential database. Affected are unsupported versions 9.0.20.x and potentially earlier legacy releases, meaning no vendor patch will be issued for these branches - upgrade to a supported release is the only vendor-endorsed remediation. The CVSS 4.0 vector (AV:L/PR:H/AT:P) confirms exploitation requires local, high-privilege access and specific attack conditions, significantly constraining real-world risk; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Control-M/Enterprise Manager is BMC Software's centralized workload automation and job scheduling management platform, identified via CPE cpe:2.3:a:bmc:control-m/enterprise_manager:*:*:*:*:*:*:*:*. The root cause is classified as CWE-328 (Use of Weak Hash), meaning the application hashes account passwords using a cryptographically inadequate algorithm or insufficiently hardened configuration - such as MD5, SHA-1 without salting, or iterations insufficient to resist GPU-accelerated brute force. Unlike plaintext storage, weak hashing is a second-order vulnerability: it matters only after credential data is exfiltrated, at which point the attacker can mount offline dictionary or rainbow-table attacks to recover plaintext passwords faster than a strong algorithm (bcrypt, scrypt, Argon2) would permit. The local attack vector and high-privilege requirement in the CVSS 4.0 score confirm that the credential store is not directly network-accessible and requires elevated OS or application-level rights to read.

RemediationAI

The primary and only vendor-endorsed remediation is to upgrade Control-M/Enterprise Manager from the unsupported 9.0.20.x branch to a currently supported release that implements adequately strong password hashing; consult the BMC knowledge article at https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000GFeDCAW&type=Solution for the recommended target version. No patch will be backported to unsupported versions. For organizations that cannot immediately upgrade, compensating controls should focus on reducing the likelihood of credential data exfiltration: restrict local and administrative access to the Control-M/EM server to only explicitly authorized accounts (trade-off: operational friction for admins), enable file-integrity monitoring on directories containing credential or configuration data to detect unauthorized reads (trade-off: alert volume), and enforce network segmentation preventing lateral movement from the EM host. Additionally, audit whether Control-M admin account passwords are reused across other enterprise systems - if so, rotate those credentials proactively, as a successful offline crack would expose those systems too.