CVE-2026-10538— Improper deserialization handling in Control-M Components
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| BMC | Control-M/Enterprise Manager | 9.0.21 | unaffected |
9.0.20< 9.0.21 | affected | ||
| BMC | Control-M/Server | 9.0.21 | unaffected |
9.0.20< 9.0.21 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10538
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper deserialization handling in Control-M Components
Source: CVE Program / CVE List V5
Vulnerability Description
Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
BMC Control-M/Enterprise Manager 反序列化注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
BMC Control-M/Enterprise Manager是BMC公司的一款企业作业调度与资源管理软件。 BMC Control-M/Enterprise Manager存在反序列化注入漏洞，该漏洞源于消息消费功能对用户控制数据的反序列化类型限制不足，可能导致经过身份验证的攻击者通过特制序列化内容触发意外服务器端行为。以下版本受到影响：9.0.20.x版本和更早版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| BMC | Control-M/Enterprise Manager | 9.0.21 | - | |
| BMC | Control-M/Server | 9.0.21 | - |
II. Public POCs for CVE-2026-10538
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10538
请登录查看更多情报信息。
Other References for CVE-2026-10538 (1)
Same Patch Batch · BMC · 2026-07-01 · 3 CVEs total
| CVE-2026-10539 | 9.0 CRITICAL | Unauthenticated command injection in Control-M/Server communication command |
| CVE-2026-10540 | 5.6 MEDIUM | Weak password hash protection in Control-M/Entreprise Manager |
IV. Related Vulnerabilities
Same vendor: BMC
- CVE-2026-10539
Unauthenticated command injection in Control-M/Server commun - CVE-2026-10540
Weak password hash protection in Control-M/Entreprise Manage - CVE-2025-55108
BMC Control-M/Agent default configuration does not enforce S - CVE-2025-55118
BMC Control-M/Agent memory corruption in SSL/TLS communicati - CVE-2025-55117
BMC Control-M/Agent buffer overflow in SSL/TLS communication
Same weakness: CWE-502
- CVE-2026-11536
IBM WebSphere Application Server is affected by a remote cod - CVE-2026-12118
IBM webMethods Integration could allow an unauthenticated re - CVE-2026-57859
e107 Second-Order Code Execution via eval()-Based Deserializ - CVE-2026-1360
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Objec - CVE-2026-65883
Joomla Extension - aimy-extensions.com - RCE via PHP object
V. Comments for CVE-2026-10538
No comments yet