Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Nov 5, 2025The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS aCVE-2025-55108 · Other software · BMC · reported by cert@airbus.comCritical 9.5
The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE: * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured.CVE-2025-55118 · Other software · BMC · reported by cert@airbus.comHigh 8.4
Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n"
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured.CVE-2025-55117 · Other software · BMC · reported by cert@airbus.comMedium 6.3
A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; * Control-M/Agent 9.0.21 and 9.0.22: Agent router configuration uses the non-default settings "JAVA_AR=N" and "use_openssl=n".
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent.CVE-2025-55116 · Other software · BMC · reported by cert@airbus.comCritical 9.3
A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent.CVE-2025-55115 · Other software · BMC · reported by cert@airbus.comCritical 9.3
A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions. This vulnerability was fixed in 9.0.20.100 and above.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake iCVE-2025-55114 · Other software · BMC · reported by cert@airbus.comMedium 6.9
The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agent to vulnerabilities in the SSL/TLS implementation under certain non-default conditions (e.g. CVE-2025-55117 or CVE-2025-55118) or potentially to resource exhaustion.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 anCVE-2025-55113 · Other software · BMC · reported by cert@airbus.comCritical 9.5
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a specially crafted certificate.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish crypCVE-2025-55112 · Other software · BMC · reported by cert@airbus.comHigh 7.6
Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key could decrypt network traffic between the Control-M/Agent and Server.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsuppoCVE-2025-55111 · Other software · BMC · reported by cert@airbus.comMedium 5.7
Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating to SSL files, keystore and policies. An attacker with local access to the system running the Agent can access these files.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented.CVE-2025-55110 · Other software · BMC · reported by cert@airbus.comMedium 5.7
Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data using this password.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Sep 16, 2025An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when CVE-2025-55109 · Other software · BMC · reported by cert@airbus.comCritical 9.5
An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS#12 keystore. A remote attacker with access to a signed third-party or demo certificate for client authentication can bypass the need for a certificate signed by the certificate authority of the organization during authentication on the Control-M/Agent. The Control-M/Agent contains hardcoded certificates which are only trusted as fallback if an empty kdb keystore is used; they are never trusted if a PKCS#12 keystore is used. All of these certificates are now expired. In addition, the Control-M/Agent default kdb and PKCS#12 keystores contain trusted third-party certificates (external recognized CAs and default self-signed demo certificates) which are trusted for client authentication.
- Product
- Control-M/Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbmcapps.my.site.combmcapps.my.site.com
Apr 30, 2020BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).CVE-2019-19220 · Other software · Bmcsoftware · reported by MITREHigh 8.8
BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).
- Product
- Control-m/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Apr 30, 2020BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download.CVE-2019-19219 · Other software · Bmcsoftware · reported by MITREHigh 7.5
BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download.
- Product
- Control-m/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Apr 30, 2020BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.CVE-2019-19218 · Other software · Bmcsoftware · reported by MITREHigh 7.5
BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.
- Product
- Control-m/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Apr 30, 2020BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.CVE-2019-19217 · Other software · Bmcsoftware · reported by MITREHigh 8.8
BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.
- Product
- Control-m/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Apr 30, 2020BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.CVE-2019-19216 · Other software · Bmcsoftware · reported by MITREHigh 8.8
BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.
- Product
- Control-m/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Apr 30, 2020A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the emCVE-2019-19215 · Other software · Bmcsoftware · reported by MITREHigh 8.8
A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server.
- Product
- Control-m/agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.