CVE-2026-10537 identified for Control-M/Enterprise Manager and Control-M/Server versions >= 9.0.20 and < 9.0.22: Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

Knowledge Article

Article Number

000451790

Old Article Number

Article Type

Solutions to a Product Problem

Title

CVE-2026-10537 identified for Control-M/Enterprise Manager and Control-M/Server versions >= 9.0.20 and < 9.0.22: Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

Summary

Product

Control-M/Enterprise Manager

Component

Control-M/Enterprise Manager

Applies to

Control-M/Enterprise Manager versions greater than or equal to 9.0.20 and less than 9.0.22
Control-M/Server versions greater than or equal to 9.0.20 and less than 9.0.22

Problem

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.

CWE-305 Authentication bypass by primary weakness

Product	Affected	Unaffected
BMC Control-M/Enterprise Manager	from 9.0.20 before 9.0.22 Default configuration is affected	9.0.22 and later
BMC Control-M/Server	from 9.0.20 before 9.0.22 Default configuration is affected	9.0.22 and later

Cause

WBL-357089 & WBL-357043

Solution

Solution:

Upgrade to version 9.0.22 or higher

Attachment(s):