CVE-2026-23781

9.8 criticalEPSS 0.3%

Critical (9.8) in bmc control-m\/managed file transfer. EPSS 0.3% chance of exploitation in the next 30 days.

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2026-04-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bmc:control-m\/managed_file_transfer

References

https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9022/Patches/Control-M-MFT-PAAFP-9-0-22-025/
https://www.bmc.com/support/resources/issue-defect-management.html

Check your stack JSON