BMC vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-10539 A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input.Critical 9.5 · Jul 1, 2026
• CVE-2026-10538 Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support ConHigh 8.9 · Jul 1, 2026
• CVE-2026-23781 An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.Critical 9.8 · Apr 10, 2026
• CVE-2026-23782 An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.High 7.5 · Apr 10, 2026
• CVE-2026-23780 An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.High 8.8 · Apr 10, 2026
• CVE-2025-71260 BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handlingHigh 8.7 · Mar 19, 2026
• CVE-2024-58298 Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP fileCritical 9.2 · Dec 11, 2025
• CVE-2025-55108 The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS aCritical 9.5 · Nov 5, 2025
• CVE-2025-55118 Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured.High 8.4 · Sep 16, 2025
• CVE-2025-55116 A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent.Critical 9.3 · Sep 16, 2025
• CVE-2025-55115 A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent.Critical 9.3 · Sep 16, 2025
• CVE-2025-55113 If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 anCritical 9.5 · Sep 16, 2025
• CVE-2025-55112 Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish crypHigh 7.6 · Sep 16, 2025
• CVE-2025-55109 An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when Critical 9.5 · Sep 16, 2025
• CVE-2024-34399 **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04.Critical 9.8 · Sep 18, 2024
• CVE-2021-35002 BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability.High 8.8 · May 7, 2024
• CVE-2020-35593 BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host.High 7.8 · Sep 5, 2023
• CVE-2017-9453 BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.Critical 9 · Sep 5, 2023
• CVE-2023-39122 BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter.Critical 9.8 · Jul 31, 2023
• CVE-2023-34258 An issue was discovered in BMC Patrol before 22.1.00.High 7.5 · May 31, 2023
• CVE-2023-34257 An issue was discovered in BMC Patrol through 23.1.00.Critical 9.8 · May 31, 2023
• CVE-2023-26550 A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.Critical 9.8 · Feb 25, 2023
• CVE-2022-35865 This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109.Critical 9.8 · Aug 3, 2022
• CVE-2022-24047 This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102.Critical 9.8 · Feb 18, 2022
• CVE-2017-17677 BMC Remedy 9.1SP3 is affected by authenticated code execution.High 8.8 · May 19, 2021