CVE-2026-10537: Remote unauthenticated information disclosure and denial of service due to unauthenticated service access
A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability.
This vulnerability affects :
Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects Control-M/Enterprise Manager and Control-M/Server versions from 9.0.20 up to, but not including, 9.0.22. Earlier unsupported versions may also be affected.
Does an attacker need credentials or user interaction?
No. The stated attack vector is network-based, with no privileges or user interaction required; the issue concerns unauthenticated access to service functionality.
What impact can exploitation have?
An unauthenticated remote user may be able to expose information or affect service availability. The provided severity vector indicates low confidentiality impact and no stated integrity impact.