A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action…
Priority MEDIUM 41CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server.
Why it matters now
EPSS 0.01596 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bmcsoftware:control-m\/agent:7.0.00.000:*:*:*:*:*:*:* | 7.0.00.000 | Vulnerable | BMC Software, Inc. |
- cpe:2.3:a:bmcsoftware:control-m\/agent:7.0.00.000:*:*:*:*:*:*:* Versions 7.0.00.000 Vulnerable ·BMC Software, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-19215
- 2026-10-03 Alias added: GHSA-wfjr-fx5q-m6gw
References
More BMC Software, Inc. Control-m/agent vulnerabilities
- TI-2019-13850 BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2). CVSS 3.1HIGH 8.8
- TI-2019-13847 BMC Control-M/Agent 7.0.00.000 allows OS Command Injection. CVSS 3.1HIGH 8.8
- TI-2019-13846 BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy. CVSS 3.1HIGH 8.8
- TI-2019-13849 BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download. CVSS 3.1HIGH 7.5
- TI-2019-13848 BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage. CVSS 3.1HIGH 7.5
Sources
- CVE-2019-19215 · CVE Program
- CVE-2019-19215 · NVD
- FIRST EPSS
- GHSA-wfjr-fx5q-m6gw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences