Critical severity · published Jul 1, 2026
CVE-2026-10539
Unauthenticated command injection in Control-M/Server communication command
9.0
CVSS
0.4%
EPSS
No
On KEV
Description
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server.
This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Control-M/Server · BMC
9.0.20 through 9.0.21.200 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10539
bmcapps.my.site.com
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000GFZNCA4&type=Solution
More from Control-M/Server
8.0
CVE-2026-10538
Improper deserialization handling in Control-M Components
7.8
CVE-2025-48709
BMC Control-M/Server cleartext database credentials in process lists and logs
5.3
CVE-2026-10537
Remote unauthenticated information disclosure and denial of service due to unauthenticated service access