CVE-2026-10537

MediumCVSS 5.3

Published: 27/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A misconfiguration issue in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, potentially resulting in information exposure or affecting service availability. This affects Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions, and Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.

Risk Assessment

An unauthenticated attacker may access service functionality, potentially leading to information disclosure or availability disruption. This may impact confidentiality or availability of Control-M systems.

Recommendation

Upgrade Control-M/Enterprise Manager and Control-M/Server to a version newer than 9.0.22 or apply vendor guidance. Until then, restrict network access to vulnerable services.

Other vulnerabilities in Control-M

CVE-2026-10538High
A vulnerability in the messaging consumer functionality of unsupported Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and earlier allows deserialization of user-controlled data without sufficient restriction of allowed object types. This may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

Original NVD description (English source)

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

Vulnerability data from NVD (NIST) · CISA KEV · EPSS