Read the docs
TI-2025-34796 Aliases CVE-2025-55108GHSA-p7ww-wjh2-g3gw

Missing authentication in BMC Control-M/Agent

Priority MEDIUM 50CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE:  * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00825 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BMCControl-M/Agent9.0.22 and later; 9.0.21 and later; 9.0.20 and later; 9.0.19 and later; 9.0.18 and later—No fix listedCNA
  • Control-M/Agent VendorBMC Affected 9.0.22 and later; 9.0.21 and later; 9.0.20 and later; 9.0.19 and later; 9.0.18 and later Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bmc:control-m\/agent:*:*:*:*:*:*:*:*——BMC
  • cpe:2.3:a:bmc:control-m\/agent:*:*:*:*:*:*:*:* Versions — — ·BMC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55108
  2. 2026-10-03 Alias added: GHSA-p7ww-wjh2-g3gw

References

Advisory 1

Other 2

  • TI-2023-20303 BMC Control-M through 9.0.20.200 allows SQL injection via the… CVSS 3.1CRITICAL 9.8
  • TI-2023-17091 An issue was discovered in BMC Patrol through 23.1.00. CVSS 3.1CRITICAL 9.8
  • TI-2023-11687 A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2025-43385 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE CVSS 4.0HIGH 8.7
  • TI-2014-04009 BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows… CVSS 2.0HIGH 7.5
  • TI-2023-17092 An issue was discovered in BMC Patrol before 22.1.00. CVSS 3.1HIGH 7.5
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences