p PatchFirst

CVE-2026-10537

CVE-2026-10537 · Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A misconfiguration issue in the affected service in Control-M/Enterprise Manager and Control-M/Server may allow unauthenticated remote users to access certain service functionality, which could potentially result in information exposure or affect service availability. This vulnerability affects : * Control-M/Enterprise Manager versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions. * Control-M/Server versions 9.0.20 to 9.0.22 (excluded) and potentially earlier unsupported versions

CVSS 6.9 · Medium · Fix available

Published
Updated

Affected products and versions

  • control-m/enterprise manager

    Versions
    • 9.0.22: Not affected (semver)
    • ≥ 9.0.20, < 9.0.22: Affected (semver)

    Update to 9.0.22

  • control-m/server

    Versions
    • 9.0.22: Not affected (semver)
    • ≥ 9.0.20, < 9.0.22: Affected (semver)

    Update to 9.0.22

Original sources

Check your server →