CVE-2026-10539

CRITICAL

Unauthenticated command injection in Control-M/Server communication command

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-10539. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-10539, a command injection vulnerability in Control-M/Server's communication command due to insufficient input sanitization. The code includes placeholder logic but lacks actual exploit implementation.

Description

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier unsupported versions.

Exploits (1)

github STUB 1 stars

by HermesNA-1 · pythonpoc

https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-10539_control-mserver_communication_command.py

View Code ZIP pw:eip

This repository contains an auto-generated stub module for CVE-2026-10539, a command injection vulnerability in Control-M/Server's communication command due to insufficient input sanitization. The code includes placeholder logic but lacks actual exploit implementation.

Classification

Stub 99%

Attack Type

Rce

Complexity

Moderate

Reliability

Theoretical

Target: Control-M/Server (specific version not specified)

No auth needed

Prerequisites: Network access to Control-M/Server communication port · Unauthenticated access to vulnerable endpoint

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1

Core References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA3cx000000GFZNCA4&type=Solution

Scores

CVSS v3 9.0

EPSS 0.0024

EPSS Percentile 14.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-305

Status published

Products (2)

BMC/Control-M/Server 9.0.20 - 9.0.21.200

BMC/Control-M/Server 9.0.21.300

Published Jul 01, 2026

Tracked Since Jul 01, 2026