An API management endpoint in BMC Control‑M/MFT allows unauthenticated users to retrieve an API identifier and its corresponding secret. These exposed secrets give an attacker the ability to call privileged API operations, effectively granting unauthorized access to the system and the data it manages. The flaw is a typical example of a weakness that permits elevation of privilege through credential compromise.

BMC Control‑M/MFT versions 9.0.20 through 9.0.22 are affected. The vulnerability applies to both the Control‑M and MFT components within these release ranges.

The CVSS score of 7.5 indicates a high level of risk, while the EPSS score of less than 1% suggests that widespread exploitation may be limited, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the combination of unauthenticated access and the ability to leverage secret credentials presents a clear threat vector over the network, making the issuance of a patch a priority for affected installations.