{"id":"CVE-2026-10537","kind":"vulnerability","aliases":["CVE-2026-10537"],"related":[],"title":"BMC Control-M: misconfiguration lets unauthenticated remote users reach services","description":"A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.\n\n\n\n\nThis vulnerability affects :\n\n  *  Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.\n  *  Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions","summary":"Control-M/Enterprise Manager and Control-M/Server contain a misconfiguration that lets unauthenticated remote users access certain service functions. The exposure could leak information or disrupt service availability.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-m","enterprise-manager","on-prem","scheduler","vendor"],"not_affected_if":["version-9.0.22-or-later"],"how_to_check":"- Check the installed Control-M/Server and Control-M/Enterprise Manager version against the affected range: `9.0.20` up to but not including `9.0.22`, plus earlier unsupported versions\n- Review the service configuration for the affected service as described in the vendor advisory: unknown","fix":"- Upgrade Control-M/Server and Control-M/Enterprise Manager to `9.0.22` or later\n- Apply the vendor's configuration fix for the affected service if upgrading is delayed: unknown","status":"open","published_at":"2026-10-27T14:16:33+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","triaged_at":"2026-10-27T14:33:06+00:00","updated_at":"2026-10-27T14:33:06+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-27T14:33:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Control-M/Server and Control-M/Enterprise Manager to `9.0.22` or later\n- Apply the vendor's configuration fix for the affected service if upgrading is delayed: unknown","reach":"network","title":"BMC Control-M: misconfiguration lets unauthenticated remote users reach services","impact":"medium","summary":"Control-M/Enterprise Manager and Control-M/Server contain a misconfiguration that lets unauthenticated remote users access certain service functions. The exposure could leak information or disrupt service availability.","category":"vendor","nicknames":[],"who_cares":["control-m","enterprise-manager","scheduler","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated remote users reach service functions, leaking information or disrupting availability","analyst_note":"Check the BMC Control-M advisory for the specific misconfiguration, the affected service and the fix steps; source is NVD only at https://nvd.nist.gov/vuln/detail/CVE-2026-10537","how_to_check":"- Check the installed Control-M/Server and Control-M/Enterprise Manager version against the affected range: `9.0.20` up to but not including `9.0.22`, plus earlier unsupported versions\n- Review the service configuration for the affected service as described in the vendor advisory: unknown","needs_analyst":true,"not_affected_if":["version-9.0.22-or-later"],"who_is_affected":"Teams running Control-M/Enterprise Manager or Control-M/Server in the affected version range, especially those with network reach from untrusted networks to the affected service. Sources do not say which specific configuration triggers the issue, so exposure beyond the version range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":3404,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10537':14A,17A '-2026':13A,16A '/enterprise':32B,71C,105C '/server':38B,77C,120C '9.0.20':108C,122C '9.0.22':110C,124C 'access':47B,84C 'affect':65C,96C,101C 'allow':79C 'avail':59B,98C 'bmc':1A 'certain':48B,85C 'contain':39B 'control':3A,19B,30B,36B,69C,75C,103C,118C 'control-m':2A,18B,29B,35B,68C,74C,102C,117C 'could':53B,89C 'cve':12A,15A 'disrupt':57B 'earlier':114C,128C 'enterpris':22B 'enterprise-manag':21B 'exclud':111C,125C 'exposur':52B,94C 'function':50B,87C 'inform':55B,93C 'issu':62C 'leak':54B 'let':6A,43B 'm':4A,20B,31B,37B,70C,76C,104C,119C 'manag':23B,33B,72C,106C 'may':78C 'misconfigur':5A,41B,61C 'on-prem':24B 'potenti':90C,113C,127C 'prem':26B 'reach':10A 'remot':8A,45B,81C 'result':91C 'schedul':27B 'servic':11A,49B,58B,66C,86C,97C 'unauthent':7A,44B,80C 'unsupport':115C,129C 'user':9A,46B,82C 'vendor':28B 'version':107C,116C,121C,130C 'vulner':100C","nicknames":[],"mitigations":[],"who_affected":"Teams running Control-M/Enterprise Manager or Control-M/Server in the affected version range, especially those with network reach from untrusted networks to the affected service. Sources do not say which specific configuration triggers the issue, so exposure beyond the version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cert@airbus.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10537","severity":null,"published_at":"2026-10-27T14:16:33+00:00","modified_at":"2026-10-27T14:16:33+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","fetched_at":"2026-10-27T14:32:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}