CVE-2026-10540

MEDIUM

Weak password hash protection in Control-M/Entreprise Manager

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-10540. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-10540, a vulnerability in Control-M/Enterprise Manager involving weak protections for stored password hashes. The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation for offline password recovery attacks.

Description

The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-10540_the_control-menterprise_manager.py

This repository contains an auto-generated stub module for CVE-2026-10540, a vulnerability in Control-M/Enterprise Manager involving weak protections for stored password hashes. The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation for offline password recovery attacks.

Classification
Stub 99%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Theoretical
Target: Control-M/Enterprise Manager
No auth needed
Prerequisites: Access to credential data (e.g., database or configuration files) · Network connectivity to the target (for the placeholder `check` method)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 5.6
EPSS 0.0008
EPSS Percentile 0.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-328
Status published
Products (2)
BMC/Control-M/Enterprise Manager 9.0.20 - 9.0.21
BMC/Control-M/Enterprise Manager 9.0.21
Published Jul 01, 2026
Tracked Since Jul 01, 2026