CVE-2026-23781: Critical severity BMC Control-M/MFT vulnerability
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23781?
CVE-2026-23781 has been classified as a high severity vulnerability due to the exposure of hardcoded credentials.
How do I fix CVE-2026-23781?
To fix CVE-2026-23781, you should change the default debug user credentials and follow security best practices for user management.
What versions of BMC Control-M/MFT are affected by CVE-2026-23781?
BMC Control-M/MFT versions 9.0.20 through 9.0.22 are affected by CVE-2026-23781.
What risks are associated with CVE-2026-23781?
The risks associated with CVE-2026-23781 include unauthorized access to the MFT API debug interface, which can lead to further exploitation.
Is there a patch available for CVE-2026-23781?
A patch may be available for CVE-2026-23781, and it's recommended to consult BMC's support resources for the latest updates.