CVE-2026-10539 detected on Control-M/Server for UNIX and Microsoft Windows: Unauthenticated remote command injection.

Knowledge Article

Article Number

000450397

Old Article Number

Article Type

Solutions to a Product Problem

Title

CVE-2026-10539 detected on Control-M/Server for UNIX and Microsoft Windows: Unauthenticated remote command injection.

Summary

Product

Control-M/Server for UNIX and Microsoft Windows

Component

Control-M/Server for UNIX and Microsoft Windows

Applies to

Control-M/Server for UNIX and Microsoft Windows 9.0.20.x to 9.0.21.200

Problem

CWE-305 Authentication bypass by primary weakness

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.

Product

Affected

Unaffected

Control-M/Server

Default status is affected

9.0.20.x to 9.0.21.200 (included)

9.0.21.300 and later

Cause

WBL-357073

Solution

Additional Information:

CVE-2026-10539 affects supported version 9.0.21.200

Solution:

Upgrade to 9.0.21.300 version or higher

Attachment(s):