A misconfiguration in BMC Control‑M services permits unauthenticated remote users to invoke specific functionality, potentially revealing sensitive information or disrupting service availability. The vulnerability is a configuration flaw that fails to enforce authentication controls (CWE‑305). Attackers who reach the exposed endpoints can call privileged actions without credentials, leading to data exposure or denial of service if the service misbehaves under unauthorized load.

Victims are BMC Control‑M Enterprise Manager and BMC Control‑M Server. The affected releases include Control‑M/Enterprise Manager versions 9.0.20 through 9.0.22 (the 9.0.22 build is excluded) and earlier unsupported versions, as well as Control‑M/Server versions 9.0.20 to 9.0.22 (9.0.22 excluded) and earlier unsupported releases.

With a CVSS score of 6.9, the weakness is moderate but not trivial; the EPSS score is unavailable, and the vulnerability is not currently listed in CISA’s KEV catalog. Because the flaw permits unauthenticated remote access, the primary attack vector is external network traffic targeting the misconfigured service endpoints. No special privileges or user interaction are required beyond network connectivity, so an attacker can exploit the flaw from any external host that can reach the Control‑M service. No embargoed or scheduled patch is announced, so immediate operational hardening is recommended until vendor releases a fix.