Login Request a demo
CO
Product
Control-M
by BMC · last CVE Aug 7, 2025
6
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 2High 2Medium 2Low 0
Severity
All severities6Critical2High2Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Control-M to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-39122
9.8
1%
Jul 31
BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter
Affected: before 9.0.21
CVE-2023-26550
9.8
1%
Feb 25
A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field
Affected: before 9.0.20.214
CVE-2025-48709
7.8
0%
Aug 7
BMC Control-M/Server cleartext database credentials in process lists and logs
Affected: 9.0.21.300 before 9.0.21.300 PACTV.9.0.21.307
CVE-2024-1605
7.8
0%
Mar 18
DLL side-loading in BMC Control-M
Affected: 9.0.20 before 9.0.20.238; 9.0.21 before 9.0.21.201
CVE-2024-1604
6.8
0%
Mar 18
Incorrect authorization in BMC Control-M
Affected: 9.0.20 before 9.0.20.238; 9.0.21 before 9.0.21.201
CVE-2024-1606
5.4
0%
Mar 18
HTML injection in BMC Control-M
Affected: 9.0.20 before 9.0.20.238; 9.0.21 before 9.0.21.200
Showing 6