CVE-2026-10539CWE-305

Unauthenticated command injection in Control-M/Server communication command

Critical · published July 1, 2026

CVSS v4.0
9.5
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server.

This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.

The record
Technical detail
CVSS v4.0
9.5 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00424 · 35.6th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2026-07-01T07:55Z
EPSS history
Timeline
  • 01 JUL 07:55Z
    Unauthenticated command injection in Control-M/Server communication command
    cvelistv5