Which versions of Control-M/Server are affected by EUVD-2026-40925?

BMC Control-M/Server (versions 9.0.20.x-9.0.21.200) is vulnerable to unauthenticated remote command execution (CVE-2026-10539, CVSS 9.5), permitting complete server compromise without authentication.

How to fix or mitigate EUVD-2026-40925?

Within 24 hours: Identify all Control-M/Server instances in versions 9.0.20.x through 9.0.21.200 and restrict inbound network access to administrative subnets via firewall rules. Within 7 days: Deploy network-based intrusion detection (IDS) rules and enable detailed audit logging on affected servers; engage BMC Support for patch timeline. Within 30 days: Execute upgrade to patched release version or implement full network segregation of vulnerable instances pending vendor remediation.

Control-M/Server EUVD-2026-40925

Q: What is the CVSS score of EUVD-2026-40925?

EUVD-2026-40925 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-10539 CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-07-01 airbus

GHSA-qhfm-m6pm-jrq6

Authentication Bypass Control M Server Bmc

9.5

CVSS 4.0 · Vendor: airbus

Severity by source

Vendor (airbus) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Network-reachable and unauthenticated (AV:N/PR:N), but the 'under certain conditions' precondition maps to AC:H; injected commands executed by the server escape the component boundary (S:C) with full C/I/A loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (airbus).

CVSS VectorVendor: airbus

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 08:30 vuln.today

DescriptionCVE.org

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server.

This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.

AnalysisAI

Unauthenticated command execution in BMC Control-M/Server (versions 9.0.20.x through 9.0.21.200) arises because a Control-M/Server communication command fails to sufficiently filter or sanitize user-supplied input, allowing an attacker to run unauthorized commands and potentially fully compromise the affected server. The flaw carries a critical CVSS 4.0 base score of 9.5 and is classified as an authentication bypass by Airbus, who reported it. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Control-M/Server is the central scheduling and orchestration component of BMC's Control-M workload automation platform, coordinating batch jobs across enterprise systems and communicating with distributed Control-M/Agents over its own network protocol. The vulnerability sits in one of these server communication commands, which trusts and processes attacker-controllable input without adequate validation, enabling command injection into server-side execution. The assigned weakness class, CWE-305 (Authentication Bypass by Primary Weakness), together with the vendor's 'Authentication Bypass' tag, indicates the affected communication path can be reached and abused without first authenticating, so the input-handling defect doubles as an access-control failure rather than a mere post-auth injection. The CPE cpe:2.3:a:bmc:control-m/server:*:*:*:*:*:*:*:* confirms the BMC Control-M/Server application as the single affected product across all listed sub-versions.

RemediationAI

Patch available per vendor advisory: consult BMC's knowledge article at https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000GFZNCA4&type=Solution to obtain the fixed Control-M/Server build, as an exact fixed version number is not stated in the provided data - upgrade above 9.0.21.200 to the version BMC designates as remediated. Because the affected path is a network-facing Control-M/Server communication command, apply compensating controls until patched: restrict network access to the Control-M/Server listening ports so that only trusted Control-M/Agent and console hosts can connect (for example via host firewall rules or network ACLs), which limits reachability but will break connectivity for any legitimate client not on the allowlist and must be scoped to your agent topology. Place the Control-M/Server on a segmented management network isolated from general user and internet-facing traffic, accepting the operational overhead of tighter routing, and increase monitoring of Control-M/Server logs for anomalous or malformed communication commands. Confirm with BMC whether any configuration setting disables or hardens the vulnerable command as an interim measure.