CVE-2026-10538: Control-M Server RCE Vulnerability

CVE-2026-10538 Overview

CVE-2026-10538 is an insecure deserialization vulnerability [CWE-502] affecting out-of-support BMC Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. The messaging consumer functionality deserializes user-controlled data without sufficiently restricting allowed object types. An authenticated attacker can send crafted serialized content to trigger unintended server-side behavior. Control-M is widely deployed as a workload automation platform in enterprise environments, making compromise of these components a pathway to broader operational disruption.

Critical Impact
An authenticated attacker sending crafted serialized objects to the messaging consumer can achieve high impact on confidentiality, integrity, and availability of the Control-M server and adjacent systems.

Affected Products

BMC Control-M/Server version 9.0.20.x and potentially earlier (out of support)
BMC Control-M/Enterprise Manager version 9.0.20.x and potentially earlier (out of support)
Deployments running the messaging consumer component in impacted versions

Discovery Timeline

2026-07-01 - CVE-2026-10538 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-10538

Vulnerability Analysis

The vulnerability resides in the messaging consumer functionality of Control-M/Server and Control-M/Enterprise Manager. The consumer accepts serialized objects from clients and reconstructs them without validating that the incoming types belong to a safe allow-list. Attackers with valid authentication can submit gadget chains that execute logic during deserialization. This class of flaw is tracked as [CWE-502] Deserialization of Untrusted Data. Because the flaw affects out-of-support releases, no vendor patch will be issued for the vulnerable branch, and mitigation depends on upgrading or restricting access.

Root Cause

The deserialization routine used by the messaging consumer does not enforce a strict allow-list of expected classes. Any serializable type reachable on the classpath can be instantiated during object graph reconstruction. When gadget classes with side-effecting readObject, readResolve, or equivalent methods are present, the reconstruction step performs unintended operations. This design flaw stems from treating message payloads as trusted structured data rather than as untrusted input requiring validation before instantiation.

Attack Vector

The attack requires network access to the messaging consumer and valid authenticated credentials. An attacker crafts a serialized payload containing a gadget chain, then submits it through the consumer channel. The server deserializes the payload, invoking attacker-influenced methods during object graph reconstruction. The result is unintended server-side behavior that impacts confidentiality, integrity, and availability of the Control-M installation and downstream systems it orchestrates.

No verified public exploit code is available. Technical details are described in the BMC Solutions Knowledge Article.

Detection Methods for CVE-2026-10538

Indicators of Compromise

Unexpected child processes spawned by the Control-M/Server or Enterprise Manager service accounts following messaging activity
Outbound connections initiated by Control-M processes to unfamiliar destinations shortly after inbound consumer traffic
Errors or stack traces in Control-M logs referencing ObjectInputStream, readObject, or unfamiliar class names during message processing

Detection Strategies

Monitor authenticated sessions against messaging endpoints for anomalous payload sizes and serialization headers such as AC ED 00 05 (Java serialization magic bytes)
Correlate Control-M service account activity with process creation, file write, and network egress events to identify post-deserialization behavior
Alert on unexpected library or class loads within the Control-M JVM that were not observed in a baseline period

Monitoring Recommendations

Enable verbose logging on the messaging consumer and forward logs to a centralized analytics platform for retention and query
Track authentication events for Control-M accounts and flag logins from unusual source addresses or outside change windows
Baseline normal outbound network behavior of Control-M hosts and alert on deviations

How to Mitigate CVE-2026-10538

Immediate Actions Required

Inventory all Control-M/Server and Control-M/Enterprise Manager instances and identify any running version 9.0.20.x or earlier
Restrict network access to the messaging consumer to trusted management networks only, blocking exposure to broader internal or external networks
Rotate credentials for accounts authorized to interact with the messaging consumer and enforce least-privilege access
Review the BMC Solutions Knowledge Article for vendor guidance

Patch Information

BMC has confirmed the affected versions are out of support. No security patch is available for the version 9 branch. Upgrade to a currently supported Control-M release to remediate the deserialization flaw. Consult BMC support for the recommended upgrade path.

Workarounds

Place the messaging consumer behind network segmentation and firewall rules that permit only known administrative hosts
Enforce multi-factor authentication and strong password policies on all accounts capable of reaching the consumer
Disable or decommission unused Control-M components to reduce the attack surface until an upgrade completes

bash

# Example: restrict messaging consumer port to management subnet (Linux iptables)
iptables -A INPUT -p tcp --dport <controlm_messaging_port> -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <controlm_messaging_port> -j DROP