CVE-2025-55108: Bmc Control-M/agent

Critical severity, CVSS 10.0. EPSS: 0.8% chance of exploitation in the next 30 days.

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE:  * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS

Affected products

• Bmc Control-M/agent: version 9.0.22 only; version 9.0.21 only; version 9.0.20 only; version 9.0.19 only; version 9.0.18 only

Published 2025-11-05. Last modified 2026-06-17.