A SQL injection flaw exists in the MFT API debug interface of BMC Control‑M/MFT versions 9.0.20 through 9.0.22. The weakness arises from improper input validation and the use of unsafe dynamic SQL, allowing an authenticated user to inject arbitrary SQL statements. Successful exploitation can read or write files on the underlying system and may allow arbitrary code execution. The flaw corresponds to CWE‑89, the classic SQL injection defect.

BMC Control‑M/MFT 9.0.20, 9.0.21, and 9.0.22 are affected. No other product versions are known to be impacted. Administrators should verify whether their installations include these specific releases.

The vulnerability carries a CVSS score of 8.8, classifying it as High severity, while the EPSS score is below 1%, indicating a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The likely attack vector is remote over the network, as the debug interface is accessed via the MFT API over HTTP/HTTPS. Exploitation requires authenticated access to the API; once authenticated, the attacker can craft malicious queries to perform file manipulation and potentially execute system commands.