BMC Control-M/Server communication command input-sanitization flaw enabling unauthenticated remote command execution

#requires -Version 5.1
<#
  Check-CVE-2026-10539.ps1
  Detects Control-M/Server builds in the vulnerable range 9.0.20.x .. 9.0.21.200.
  Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>
param(
    [string]$CtmHome = $env:CONTROLM_SERVER_HOME
)

function Get-CtmServerVersion {
    param([string]$Home)
    # 1) Preferred: ctm_menu / ctmgetcm output
    $ctmgetcm = Join-Path $Home 'exe\ctmgetcm.exe'
    if (Test-Path $ctmgetcm) {
        try {
            $out = & $ctmgetcm '-version' 2>$null
            if ($out -match '(\d+\.\d+\.\d+\.\d+)') { return $Matches[1] }
        } catch {}
    }
    # 2) Fallback: file version on the main server binary
    $bin = Join-Path $Home 'exe\ctmsys.exe'
    if (Test-Path $bin) {
        return (Get-Item $bin).VersionInfo.FileVersion
    }
    # 3) Registry fallback
    $reg = 'HKLM:\SOFTWARE\BMC Software\Control-M/Server'
    if (Test-Path $reg) {
        $v = (Get-ItemProperty $reg -ErrorAction SilentlyContinue).Version
        if ($v) { return $v }
    }
    return $null
}

function Compare-Version {
    param([string]$V)
    # Vulnerable: 9.0.20.0 <= V <= 9.0.21.200
    $parts = $V.Split('.') | ForEach-Object { [int]$_ }
    if ($parts.Count -lt 4) { return 'UNKNOWN' }
    $vObj  = [Version]::new($parts[0],$parts[1],$parts[2],$parts[3])
    $low   = [Version]'9.0.20.0'
    $high  = [Version]'9.0.21.200'
    $fixed = [Version]'9.0.21.201'
    if ($vObj -ge $fixed) { return 'PATCHED' }
    if ($vObj -ge $low -and $vObj -le $high) { return 'VULNERABLE' }
    if ($vObj -lt $low) { return 'VULNERABLE'  } # unsupported older branches per BMC advisory
    return 'UNKNOWN'
}

if (-not $CtmHome -or -not (Test-Path $CtmHome)) {
    Write-Output 'UNKNOWN: Control-M/Server home not found. Pass -CtmHome explicitly.'
    exit 2
}

$ver = Get-CtmServerVersion -Home $CtmHome
if (-not $ver) {
    Write-Output 'UNKNOWN: could not determine Control-M/Server version.'
    exit 2
}

$state = Compare-Version -V $ver
Write-Output ("{0}: Control-M/Server version {1}" -f $state, $ver)
switch ($state) {
    'PATCHED'    { exit 0 }
    'VULNERABLE' { exit 1 }
    default      { exit 2 }
}