{"id":"CVE-2026-10537","title":"Remote unauthenticated information disclosure and denial of service due to unauthenticated service access","summary":"A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-305"],"vendor":"BMC","product":"Control-M/Enterprise Manager","affected":["control-m_enterprise_manager >= 9.0.20 < 9.0.22","Control-M/Server >= 9.0.20 < 9.0.22"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T13:26:13.078Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-10537","references":[{"url":"https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000KMUDCA4&type=Solution"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:11:59.347Z","slug":"CVE-2026-10537","body":"## Overview\n\nA misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.\n\n\n\n\nThis vulnerability affects :\n\n  *  Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions.\n  *  Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions\n\n## Affected\n\n- `control-m_enterprise_manager >= 9.0.20 < 9.0.22`\n- `Control-M/Server >= 9.0.20 < 9.0.22`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}