CVE-2026-10539

The record

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server.  This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.

Affected packages

Related vulnerabilities

• CVE-2026-114230 When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP… CWE-305
• CVE-2026-10537 A misconfiguration issue in the affected service in Control-M/Enterprise Manager and… CWE-305
• CVE-2026-88837 BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic… CWE-305
• CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in… CWE-305
• CVE-2026-16895 A logic vulnerability (fail-open condition) has been identified within the Metasploit… CWE-305
• CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code… CWE-305
• CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from… CWE-305
• CVE-2026-1621 Authentication bypass by primary weakness vulnerability in Universal Software Inc. CWE-305