BMC Control-M/Enterprise Manager up to 9.0.20 Password Recovery Page weak hash

Summaryinfo

A vulnerability marked as problematic has been reported in BMC Control-M and Enterprise Manager up to 9.0.20. Affected by this vulnerability is an unknown functionality of the component Password Recovery Page. This manipulation causes weak hash. This vulnerability appears as CVE-2026-10540. The attack requires local access. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in BMC Control-M and Enterprise Manager up to 9.0.20. Affected by this vulnerability is an unknown code of the component Password Recovery Page. The manipulation with an unknown input leads to a weak hash vulnerability. The CWE definition for the vulnerability is CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions

It is possible to read the advisory at bmcapps.my.site.com. This vulnerability is known as CVE-2026-10540 since 06/01/2026. The exploitation appears to be easy. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

Upgrading to version 9.0.21 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40933). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• BMC

Name

• Control-M
• Enterprise Manager

Version

• 9.0.0
• 9.0.1
• 9.0.2
• 9.0.3
• 9.0.4
• 9.0.5
• 9.0.6
• 9.0.7
• 9.0.8
• 9.0.9
• 9.0.10
• 9.0.11
• 9.0.12
• 9.0.13
• 9.0.14
• 9.0.15
• 9.0.16
• 9.0.17
• 9.0.18
• 9.0.19
• 9.0.20

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion