Messaging consumer functionality

CVE-2026-10538 is a CWE-502 unsafe deserialization flaw in the messaging consumer of BMC Control-M/Server and Control-M/Enterprise Manager (EM), versions 9.0.20.x and earlier — all of which are already out of vendor support. A user who has already authenticated with high privileges can post a crafted serialized Java object into the messaging channel and cause the consumer to instantiate arbitrary types, leading to server-side behavior the operator never authorized. Because Control-M is an orchestration plane that fans out to a fleet of Control-M/Agent endpoints, S:C (scope change) here is not theoretical — the compromised process can reach into the jobs it schedules.

The vendor's HIGH / 8.0 call is defensible and roughly matches reality. It does not deserve a CRITICAL upgrade because AC:H and PR:H in the vector are real: you need a working admin session on a legacy platform, and the message path is not an unauthenticated Internet listener. It does not deserve a downgrade to MEDIUM either, because the blast radius when the chain does land — arbitrary code inside the job orchestrator that pushes commands to production agents — is fleet-wide. Net: unchanged, HIGH.

Why this verdict

• Role multiplier — Control-M is orchestration-tier: The affected component sits alongside Jenkins/GitLab Runner/Airflow in the high-value-role catalog. A successful chain ends in job pushes across the entire agent fleet — DB tiers, batch nodes, ETL. Floor is HIGH.
• Authenticated with high privilege (PR:H) — real friction, not decorative: The attacker must already hold a Control-M admin credential. This is not a network-edge unauthenticated bug; it presumes a prior compromise stage (credential theft, insider). Keeps the verdict off CRITICAL.
• Attack complexity is genuinely high (AC:H): Deserialization needs a viable gadget chain against the specific JVM/classpath shipped with Control-M 9.0.20.x. Not a spray-and-pray primitive.
• Affected population is narrow — EOL only: BMC scopes this to out-of-support 9.0.20.x. Organizations on the current LTS are not affected. That narrows installed base but does not zero it — legacy Control-M in regulated industries is common.
• No KEV, no PoC, no exposure telemetry: Zero in-the-wild indicators and negligible Internet exposure (management-plane service). Prevents a KEV-driven upgrade to CRITICAL.

Why not higher?

CRITICAL is reserved for reachable-from-anywhere or already-exploited primitives. This requires an authenticated Control-M admin session (PR:H), targets an EOL SKU only, and shows no exploitation. Elevating to CRITICAL would over-signal against fresher, unauthenticated bugs competing for the same patch window.

Why not lower?

MEDIUM understates the blast radius. Control-M isn't a line-of-business server — code execution in its service context yields job-push authority across the managed fleet, so the impact when the chain does land is fleet-scale. The role multiplier floors this at HIGH.

1. Firewall the Control-M messaging ports to a named jump-host allowlist — Restrict the EM Gateway and Control-M/Server listener to a small set of admin bastions. This immediately removes lateral reachability from the general corporate LAN. Deploy within 30 days per noisgate mitigation SLA.
2. Force MFA + step-up on all Control-M administrator accounts — The chain requires PR:H — kill credential replay by requiring MFA at the EM console and rotating any admin credentials that ever touched a workstation. Complete within 30 days.
3. Enable a strict jdk.serialFilter allow-list on the Control-M JVM — Set -Djdk.serialFilter= to reject known gadget class prefixes (org.apache.commons.collections.*, org.apache.commons.beanutils.*, com.sun.rowset.*, org.hibernate.*). Blocks the deserialization primitive even if authentication is bypassed. Apply within 30 days.
4. Enable Control-M audit log forwarding to SIEM with admin-logon alerts — Detect anomalous admin authentications from unusual hosts or off-hours. Do this in the same 30-day window so you can attribute any exploit attempt after the fact.
5. Schedule the LTS upgrade off the 9.0.20.x branch — 9.0.20.x is out of support — the fix is to move to a supported LTS train. Plan the maintenance window inside the noisgate remediation SLA (≤ 180 days).

Run on the target Control-M/Server or Control-M/EM host as a local administrator. Invoke as .\Check-CVE-2026-10538.ps1 -InstallRoot 'C:\Program Files\BMC Software\Control-M EM'. The script inspects install version metadata and reports VULNERABLE for 9.0.20.x or earlier, PATCHED for supported LTS, UNKNOWN if it cannot resolve the version.

#requires -Version 5.1
# Check-CVE-2026-10538.ps1
# Determines whether a Control-M/Server or Control-M/EM install is exposed to CVE-2026-10538.

param(
    [string]$InstallRoot = 'C:\Program Files\BMC Software\Control-M EM'
)

$ErrorActionPreference = 'Stop'

function Get-ControlMVersion {
    param([string]$Root)
    $verFile = Join-Path $Root 'version.txt'
    if (Test-Path $verFile) {
        return (Get-Content $verFile -Raw).Trim()
    }
    # Fall back to registry
    $regPaths = @(
        'HKLM:\SOFTWARE\BMC Software\Control-M\EnterpriseManager',
        'HKLM:\SOFTWARE\BMC Software\Control-M\Server'
    )
    foreach ($p in $regPaths) {
        if (Test-Path $p) {
            $v = (Get-ItemProperty -Path $p -ErrorAction SilentlyContinue).Version
            if ($v) { return $v }
        }
    }
    return $null
}

$version = Get-ControlMVersion -Root $InstallRoot

if (-not $version) {
    Write-Output 'UNKNOWN - could not resolve Control-M version'
    exit 2
}

Write-Output "Detected Control-M version: $version"

# CVE-2026-10538 affects 9.0.20.x and earlier (all EOL)
if ($version -match '^(9\.0\.(1[0-9]|20)(\.|$))|^([0-8]\.)') {
    Write-Output 'VULNERABLE'
    exit 1
}
elseif ($version -match '^9\.0\.2[1-9]' -or $version -match '^(1[0-9]|[2-9][0-9])\.') {
    Write-Output 'PATCHED'
    exit 0
}
else {
    Write-Output 'UNKNOWN - version string did not match known ranges'
    exit 2
}

Sources

1. BMC Control-M/Agent Security Update announcement
2. CISA Weekly Vulnerability Summary (SB26-173)
3. MITRE CWE-502: Deserialization of Untrusted Data
4. ysoserial gadget chain reference (Frohoff)
5. OpenJDK Serialization Filtering (`jdk.serialFilter`)
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS model and data feed
8. BMC Control-M version list (cvedetails)