Back to overview

CVE-2026-10538

HIGH
8.0
CVSS 3.1
Description
Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

Metadata

CVE ID
CVE-2026-10538
State
PUBLISHED
Assigner
airbus
Reserved
2026-06-01 12:16 UTC
Published
2026-07-01 07:56 UTC
Last updated
2026-07-01 12:24 UTC
Primary CWE
CWE-502
CWE-502 Deserialization of untrusted data
Vendor / Product
BMC / Control-M/Enterprise Manager
Sources
cve.org  ·  NVD

Severity & Metrics

8.0 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (2)
VendorProductPlatformVersions
BMC Control-M/Enterprise Manager — 9.0.21, 9.0.20 < 9.0.21
BMC Control-M/Server — 9.0.21, 9.0.20 < 9.0.21
Weakness (CWE)
CWESourceDescription
CWE-502 cna CWE-502 Deserialization of untrusted data
CVSS scores (2)
ScoreSeverityVersionSourceVector
8.9 HIGH 4.0 cna CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
8.0 HIGH 3.1 cna CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview