CVE-2026-10538
Received Received - Intake

Messaging Consumer Deserialization Flaw in Control-M

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: Airbus

Description
Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-10538
EUVD
EUVD-2026-40926

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bmc_software control-m From 9.0.20 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the messaging consumer functionality of out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. It allows deserialization of user-controlled data without sufficient restriction on the types of objects that can be deserialized.

An authenticated attacker can exploit this by sending crafted serialized content, which may trigger unintended server-side behavior.

Impact Analysis

The vulnerability can lead to unintended server-side behavior when exploited, which may include execution of malicious code or other harmful actions on the affected system.

Since the vulnerability requires authentication and involves high complexity and privileges, it could allow a privileged attacker to compromise the integrity, confidentiality, and availability of the system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart