Bmc Control-M/enterprise Manager vulnerabilities

2 CVEs affecting Bmc Control-M/enterprise Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-10540, published 2026-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-10538, published 2026-07-01. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise…
CVE-2026-10540, published 2026-07-01. Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days. The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker.…