CVE-2026-10539: Unauthenticated command injection in Control-M/Server communication command

Synopsis

An unauthenticated command injection vulnerability affects BMC Control-M/Server versions 9.0.20.x through 9.0.21.200. The flaw is reachable over the network and requires no credentials, meaning an attacker who can reach the server's communication interface can inject arbitrary operating-system commands directly. Successful exploitation gives an attacker full control of the affected server, including the ability to read, modify, or destroy data and disrupt scheduled job orchestration. A patched-image rebuild at version 9.0.21.300 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Control-M/Server communication interface over the network; internet-exposed or internally reachable deployments are in scope.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable command handler accepts unauthenticated input.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  The exploit is generally reliable but depends on certain conditions being met in the target environment (CVSS AT:P), such as a specific server configuration or timing window, rather than being unconditionally exploitable.

Blast Radius

• The attacker executes arbitrary operating-system commands on the Control-M/Server host with the privileges of the server process.
• Confidential data held on the server, including job definitions, credentials, and integration secrets, is readable by the attacker.
• The attacker can modify or delete job schedules, output data, and configuration files persisted on the server.
• Downstream systems and workloads that Control-M/Server orchestrates are exposed to lateral movement, and the server process itself can be crashed or taken offline, halting scheduled automation.