CVE-2026-23781
Hardcoded Credentials in BMC Control-M/MFT Enable Unauthorized Access
Publication date: 2026-04-10
Last updated on: 2026-04-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bmc | control-m/managed_file_transfer | From 9.0.20 (inc) to 9.0.22 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves hardcoded default debug user credentials in cleartext, which if left unchanged, can allow unauthorized access to the MFT API debug interface.
Such unauthorized access risks exposing sensitive data or system controls, potentially leading to violations of data protection standards and regulations such as GDPR and HIPAA that require strict access controls and protection of personal and health information.
Therefore, this vulnerability could negatively impact compliance with these regulations if exploited, due to insufficient authentication and potential unauthorized data access.
Can you explain this vulnerability to me?
This vulnerability exists in BMC Control-M/MFT versions 9.0.20 through 9.0.22. It involves a set of default debug user credentials that are hardcoded in cleartext within the application package. Because these credentials are embedded and not protected, if they are not changed by the user, an attacker can easily obtain them.
With these credentials, unauthorized users may gain access to the MFT API debug interface, which is intended for debugging purposes and not for general access.
How can this vulnerability impact me? :
If the default debug credentials are left unchanged, an attacker can use them to access the MFT API debug interface without authorization.
This unauthorized access could lead to potential exposure of sensitive information, manipulation of the system, or disruption of services that rely on the MFT API.