bmc control-m vulnerabilities

Latest bmc control-m CVEs

Newest publication first

1. CVE-2025-48709 BMC Control-M/Server cleartext database credentials in process lists and logs

   Published 2025-08-07

   Medium·CVSS 4.8 EPSS 0.14%

   BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a databa...

2. CVE-2024-1606 HTML injection in BMC Control-M

   Published 2024-03-18

   Medium·CVSS 5.4 EPSS 0.43%

   Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a web...

3. CVE-2024-1605 DLL side-loading in BMC Control-M

   Published 2024-03-18

   High·CVSS 7.8 EPSS 0.20%

   BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's priv...

4. CVE-2024-1604 Incorrect authorization in BMC Control-M

   Published 2024-03-18

   Medium·CVSS 6.8 EPSS 0.49%

   Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available within the application, even without proper permissions. The attacker must know th...

5. CVE-2023-39122 BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).

   Published 2023-07-31

   Critical·CVSS 9.8 EPSS 0.67%

   BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).

6. CVE-2023-26550 A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.

   Published 2023-02-25

   Critical·CVSS 9.8 EPSS 0.75%

   A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.