CVE-2026-10538

No fix known EPSS <1%CVSS 8.0

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

Published 2026-07-01 · CVE record · OSV

Products: BMC Control-M/Enterprise Manager, BMC Control-M/Server