TI-2026-81152 Aliases CVE-2026-10537

Misconfigured BMC Control-M lets unauthenticated users reach services

LOW 36CWE-305Published 2026-10-27 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

BMC Control-M/Enterprise Manager and Control-M/Server versions from 9.0.20 before 9.0.22 are affected, and potentially earlier unsupported versions as well. A misconfiguration in the affected service lets remote users reach its functions without authentication (CWE-305). An unauthenticated remote attacker can access certain service functionality, which may expose information or affect service availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00286 21st percentileScored 2026-11-07

Fix Fixed Control-M/Enterprise Manager (BMC): 9.0.22Control-M/Server (BMC): 9.0.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BMC	Control-M/Enterprise Manager	9.0.20 to before 9.0.22	9.0.22	Patch available	CNA
BMC	Control-M/Server	9.0.20 to before 9.0.22	9.0.22	Patch available	CNA

Control-M/Enterprise Manager VendorBMC Affected 9.0.20 to before 9.0.22 Fixed in 9.0.22 Patch available CNA
Control-M/Server VendorBMC Affected 9.0.20 to before 9.0.22 Fixed in 9.0.22 Patch available CNA

Remediation

Upgrade Control-M/Enterprise Manager to version 9.0.22 and Control-M/Server to version 9.0.22.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA Control-M/Enterprise Manager (BMC) Fixed in 9.0.22
Fix · CNA Control-M/Server (BMC) Fixed in 9.0.22

Timeline

2026-10-27 Threatist record created from CVE-2026-10537
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Other 1

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000KMUDCA4&type=Solution

TI-2023-20303 BMC Control-M through 9.0.20.200 allows SQL injection via the… CVSS 3.1CRITICAL 9.8
TI-2023-17091 An issue was discovered in BMC Patrol through 23.1.00. CVSS 3.1CRITICAL 9.8
TI-2023-11687 A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to… CVSS 3.1CRITICAL 9.8
TI-2025-43385 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE CVSS 4.0HIGH 8.7
TI-2014-04009 BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows… CVSS 2.0HIGH 7.5
TI-2023-17092 An issue was discovered in BMC Patrol before 22.1.00. CVSS 3.1HIGH 7.5

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences