CVE-2026-23782

7.5 highEPSS 0.3%

High (7.5) in bmc control-m\/managed file transfer. EPSS 0.3% chance of exploitation in the next 30 days.

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2026-04-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bmc:control-m\/managed_file_transfer

References

https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-308/?srid=ab0apVT3
https://www.bmc.com/support/resources/issue-defect-management.html

Check your stack JSON