NOTE:
* The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent.
* The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| BMC | Control-M/Agent | affected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Bmc | Control-m/agent | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Tracking
Sign in to view the affected projects.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 18 Nov 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE: The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. | The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE: * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS |
Thu, 06 Nov 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Bmc
Bmc control-m/agent |
|
| Vendors & Products |
Bmc
Bmc control-m/agent |
Wed, 05 Nov 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 05 Nov 2025 09:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE: The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. | |
| Title | BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution | |
| Weaknesses | CWE-306 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: airbus
Published:
Updated: 2026-02-26T17:47:16.862Z
Reserved: 2025-08-07T07:23:59.124Z
Link: CVE-2025-55108
Vulnrichment
Updated: 2025-11-05T14:07:45.998Z
NVD
Status : Awaiting Analysis
Published: 2025-11-05T09:15:32.170
Modified: 2025-11-18T15:16:31.357
Link: CVE-2025-55108
Redhat
No data.
OpenCVE Enrichment
Updated: 2025-11-06T10:07:24Z