CVE-2026-10540
Medium · 5.6CVSS
5.6
EPSS
0.1%
Published
Jul 1, 2026
CISA due date
—
The record
The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-41879 R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. CWE-328
- CVE-2026-14738 A security flaw has been discovered in exo-explore exo up to 1.0.71. CWE-328
- CVE-2026-14742 A vulnerability was determined in langchain-ai langgraph up to 1.2.4. CWE-328
- CVE-2026-14630 A vulnerability has been found in ForceInjection AI-fundermentals 2.0/3.0. CWE-328
- CVE-2026-13455 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to… CWE-328
- CVE-2026-53692 Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. CWE-328
- CVE-2026-13510 A vulnerability was found in SimStudioAI sim up to 0.6.92. CWE-328
- CVE-2026-13482 A vulnerability was detected in skypilot-org skypilot up to 0.12.0. CWE-328