CVE-2026-10540: Control-M Weak Password Hash Vulnerability

CVE-2026-10540 Overview

CVE-2026-10540 affects BMC Control-M/Enterprise Manager, a workload automation platform used for scheduling and managing enterprise batch jobs. The vulnerability stems from weak cryptographic protections applied to stored account password hashes. An attacker who obtains the credential data can perform offline password recovery attacks against the hashes. The weakness is categorized under [CWE-328] (Use of Weak Hash). The issue affects unsupported versions in the 9.0.20.x branch and potentially earlier unsupported releases. Exploitation requires local access with high privileges to reach the stored credential data.

Critical Impact
Attackers with access to Control-M/Enterprise Manager credential storage can crack account passwords offline, enabling account takeover and lateral movement within scheduled job infrastructure.

Affected Products

BMC Control-M/Enterprise Manager 9.0.20.x (unsupported)
Potentially earlier unsupported Control-M/Enterprise Manager versions
Deployments retaining legacy password hash storage formats

Discovery Timeline

2026-07-01 - CVE-2026-10540 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-10540

Vulnerability Analysis

Control-M/Enterprise Manager stores account passwords as hashes protected by a weak algorithm. The hashing scheme lacks sufficient computational cost, salting, or algorithmic strength to resist modern offline cracking. Attackers with access to the credential store can extract these hashes and run dictionary or brute-force attacks against them using GPU-accelerated tools. Recovered plaintext credentials enable authentication to the Enterprise Manager console and its managed job environments.

The attack requires local access and high privileges, which limits the initial attacker population to insiders, compromised administrators, or attackers who have already breached the host. Once credential data is exfiltrated, cracking occurs offline and leaves no artifacts on the target system.

Root Cause

The root cause is a design flaw in credential storage classified as [CWE-328] Use of Weak Hash. The chosen hashing primitive does not provide the properties required for password storage, such as memory-hard key derivation or a high iteration count. This allows an adversary with the hash file to iterate candidate passwords at high throughput.

Attack Vector

Exploitation proceeds in two stages. First, an authenticated attacker with high privileges on the Enterprise Manager host reads the stored credential data. Second, the attacker transfers the hashes to attacker-controlled infrastructure and runs offline cracking against them. No network path or user interaction is required for the cracking stage. Refer to the BMC Knowledge Article Solution for vendor-provided technical details.

Detection Methods for CVE-2026-10540

Indicators of Compromise

Unexpected read access to Control-M/Enterprise Manager credential storage files or database tables
Copies of hash data appearing in staging directories, archives, or outbound file transfers
New or unfamiliar successful logins to Enterprise Manager accounts following administrative host access
Off-hours activity by privileged operating system accounts on the Enterprise Manager server

Detection Strategies

Monitor file and database access to Control-M credential stores and alert on non-service account reads
Correlate privileged host logins with subsequent access to sensitive configuration and credential files
Baseline normal Enterprise Manager authentication patterns and alert on logins from new sources or at unusual times
Review audit logs for administrative export or backup operations that include credential data

Monitoring Recommendations

Enable file integrity monitoring on Enterprise Manager credential storage paths
Forward Control-M audit logs and host security events to a centralized analytics platform for correlation
Track privileged account usage on Enterprise Manager servers and flag deviations from established baselines
Alert on the presence of password cracking tools or hash dump utilities on management hosts

How to Mitigate CVE-2026-10540

Immediate Actions Required

Upgrade Control-M/Enterprise Manager to a supported version that applies stronger password hash protections
Rotate all Control-M/Enterprise Manager account passwords after upgrading to invalidate any previously exposed hashes
Restrict local and administrative access to Enterprise Manager hosts to a minimal set of accounts
Audit historical access to credential storage locations to determine potential prior exposure

Patch Information

BMC has published remediation guidance in the BMC Knowledge Article Solution. The affected 9.0.20.x branch is listed as unsupported, so customers should migrate to a currently supported release that includes updated password hashing.

Workarounds

Enforce strong, high-entropy passwords for all Enterprise Manager accounts to raise the cost of offline cracking
Limit filesystem and database permissions on credential stores to the Control-M service account only
Encrypt Enterprise Manager host storage volumes and backups containing credential data
Isolate Enterprise Manager servers on a management network segment with strict access controls

bash

# Configuration example
# Restrict access to Control-M credential storage on the Enterprise Manager host
chown controlm:controlm /path/to/controlm/credential-store
chmod 600 /path/to/controlm/credential-store

# Verify no unauthorized users can read the credential store
find /path/to/controlm -name 'cred*' -perm /o+r -ls