CVE-2026-10538 detected on Control-M/Enterprise Manager 9.0.20: Improper Deserialization Handling in Control-M Components

Knowledge Article

Article Number

000450396

Old Article Number

Article Type

Solutions to a Product Problem

Title

CVE-2026-10538 detected on Control-M/Enterprise Manager 9.0.20: Improper Deserialization Handling in Control-M Components

Summary

Product

Control-M/Enterprise Manager

Component

Control-M/Enterprise Manager

Applies to

Control-M/Enterprise Manager 9.0.20.x
Control-M/Server for UNIX and Microsoft Windows 9.0.20.x

Problem

CWE-502 Deserialization of untrusted data

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

Product

Affected

Unaffected

Control-M/Enterprise Manager

Default status is affected

9.0.20.x

9.0.21 and later

Control-M/Server

Default status is affected

9.0.20.x

9.0.21 and later

Cause

WBL-357075 and WBL-357041

Solution

Additional Information

CCVE-2026-10538 does not affect any currently supported versions.

Attachment(s):