Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-23780

SQL Injection in BMC Control‑M/MFT Debug API Enables Remote Code Execution

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable arbitrary file read/write operations and potentially lead to remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Control-m Control-m\/managed File Transfer
CVE-2026-23782

Unauthorized API Credential Exposure Enables Privileged Operations in BMC Control‑M/MFT

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Control-m Control-m\/managed File Transfer
CVE-2026-23781

Hard‑Coded Default Debug Credentials in BMC Control‑M/MFT

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Control-m Control-m\/managed File Transfer