TI-2026-09065 Aliases CVE-2026-10539 GHSA-qhfm-m6pm-jrq6

Unauthenticated command injection in Control-M/Server communication command

MEDIUM 43CWE-305Published 2026-07-01 · Updated 2026-07-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00424 36th percentileScored 2026-11-07

Fix Fixed Control-M/Server (BMC): 9.0.21.300

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BMC	Control-M/Server	9.0.20 – 9.0.21.200	9.0.21.300	Patch available	CNA

Control-M/Server VendorBMC Affected 9.0.20 – 9.0.21.200 Fixed in 9.0.21.300 Patch available CNA

Remediation

Fix · CNA Control-M/Server (BMC) Fixed in 9.0.21.300

Timeline

2026-10-02 Threatist record created from CVE-2026-10539
2026-10-03 Alias added: GHSA-qhfm-m6pm-jrq6

References

Other 1

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000GFZNCA4&type=Solution

TI-2023-20303 BMC Control-M through 9.0.20.200 allows SQL injection via the… CVSS 3.1CRITICAL 9.8
TI-2023-17091 An issue was discovered in BMC Patrol through 23.1.00. CVSS 3.1CRITICAL 9.8
TI-2023-11687 A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to… CVSS 3.1CRITICAL 9.8
TI-2025-43385 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE CVSS 4.0HIGH 8.7
TI-2014-04009 BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows… CVSS 2.0HIGH 7.5
TI-2023-17092 An issue was discovered in BMC Patrol before 22.1.00. CVSS 3.1HIGH 7.5

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences