CVE-2026-10537 PUBLISHED

Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

Assigner: airbus
Reserved: 01.06.2026 Published: 27.10.2026 Updated: 27.10.2026

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.

This vulnerability affects :

  • Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.
  • Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor BMC
Product Control-M/Enterprise Manager
Versions Default: affected
  • Version 9.0.22 is unaffected
  • affected from 9.0.20 to 9.0.22 (excl.)
Vendor BMC
Product Control-M/Server
Versions Default: affected
  • Version 9.0.22 is unaffected
  • affected from 9.0.20 to 9.0.22 (excl.)

Credits

  • Jean-Romain Garnier from [Airbus Security Lab](https://airbus-seclab.github.io) - <vuln@airbus.com> finder
  • Quentin Liddell from [Airbus Security Lab](https://airbus-seclab.github.io) - <vuln@airbus.com> finder

References

Problem Types

  • CWE-305 Authentication bypass by primary weakness CWE