The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords

Control-M/Enterprise Manager (BMC's job-scheduling console) stores account password hashes using a weak algorithm — no adaptive KDF, insufficient computational effort per CWE-328. An attacker who can read the hash store can run offline cracking (hashcat/john) against captured hashes and recover plaintext passwords, potentially enabling lateral movement into other systems that share credentials. Affected releases are the unsupported 9.0.20.x branch and earlier out-of-support versions; supported 9.0.21+ lines should be verified against BMC's advisory.

The vendor's MEDIUM (5.6) rating already reflects the constraint that shows up in the CVSS vector: AV:L/PR:H. In plain terms, you need local access to the EM host AND high privileges on it before you can read the hash file. If an attacker already has that position, the hash quality is the least of your problems — they can dump service credentials, tamper with jobs, and pivot directly. This is a credential-hygiene defect, not an exploitation vector. Realistic verdict is LOW.

Why this verdict

• Attacker starts post-compromise. AV:L/PR:H means the operator must already be root/service-account on the EM host. Every remaining step is amplification of an existing breach, not a new entry.
• No remote reach. Zero pre-auth surface, no network vector, no phishing angle. Cannot be used for initial access.
• Role multiplier — Control-M/EM is a scheduling console, not identity/PKI/hypervisor. Blast radius on the EM host itself is already assumed lost at step 1; the bug adds *hash-cracking* on top, which only pays off where operators reused passwords elsewhere. Not a high-value-role floor trigger — no fleet, identity, backup, or supply-chain pivot inherent to the component.
• Cracking is optional, not required. An attacker with the prerequisites can dump service credentials, hijack scheduled jobs, or plant payloads directly — the weak hash is a convenience, not a chokepoint.
• No KEV, no PoC, no observed campaigns. EPSS will land near the floor.

Why not higher?

MEDIUM would imply the bug adds meaningful new risk on top of the prerequisites. It does not — an attacker with PR:H local access to Control-M/EM already controls the scheduling plane. HIGH would require a remote or lower-privilege vector, which the vector explicitly rules out.

Why not lower?

IGNORE would be wrong because there IS a real credential-reuse pivot when operators share passwords across systems, and the fix is straightforward. LOW captures that: fix it on the normal patch cycle, don't lose sleep.

1. Restrict local access to the EM host under PAM — The whole attack chain dies at step 1 if only PAM-brokered, MFA-authenticated sessions can reach the EM server. Enforce via CyberArk/BeyondTrust/Delinea jump-host policies. No mitigation SLA at LOW — fold into normal privileged-access hardening cycle.
2. Enable database and file-read auditing on the EM credential store — Even if the hashes leak, you want to see the leak happen. Turn on DB audit for the EM repository and auditd/Sysmon file-read events for the on-disk secret files. Backlog hygiene — schedule alongside other audit-coverage gaps.
3. Rotate EM operator passwords with long, random values — A 20-character random password brute-forced against a weak (but not trivial) hash still costs an attacker meaningful GPU-time. Push operators through a password manager and set 16+ char minimums. Combine with the routine credential-rotation cycle.
4. Kill password reuse between EM and downstream systems — The only path to blast-radius growth is reuse. Enforce distinct credentials per system; where humans authenticate, front everything with SSO+MFA so a cracked EM password doesn't unlock anything else.
5. Upgrade off unsupported 9.0.20.x branch — You should already be doing this — running unsupported EM means you're missing more than just this fix. Move to a supported branch during the next maintenance window; noisgate remediation SLA for LOW is backlog (≤365 days is a reasonable cap).

Run on each Control-M/Enterprise Manager server as the ctmuser (or equivalent EM owner) account. Invoke as ./check-cve-2026-10540.sh — no arguments needed. Requires read access to the EM installation directory ($CONTROLM_SERVER_HOME / $EM_HOME).

#!/usr/bin/env bash
# check-cve-2026-10540.sh
# Detects Control-M/Enterprise Manager versions affected by weak password hashing (CWE-328).
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

EM_HOME="${EM_HOME:-${CONTROLM_SERVER_HOME:-}}"

if [[ -z "${EM_HOME}" ]]; then
  # Try common install paths
  for candidate in /opt/bmc/ControlM-EM /home/*/ctm_em /usr/openv/ControlM-EM; do
    if [[ -d "${candidate}" ]]; then EM_HOME="${candidate}"; break; fi
  done
fi

if [[ -z "${EM_HOME}" || ! -d "${EM_HOME}" ]]; then
  echo "UNKNOWN: Control-M/EM installation directory not found. Set EM_HOME and retry."
  exit 2
fi

# Prefer the version tool if present
VER=""
if [[ -x "${EM_HOME}/bin/em_version" ]]; then
  VER=$("${EM_HOME}/bin/em_version" 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)
elif [[ -x "${EM_HOME}/scripts/version.sh" ]]; then
  VER=$("${EM_HOME}/scripts/version.sh" 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)
elif [[ -f "${EM_HOME}/data/em_version.txt" ]]; then
  VER=$(grep -Eo '[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?' "${EM_HOME}/data/em_version.txt" | head -1)
fi

if [[ -z "${VER}" ]]; then
  echo "UNKNOWN: could not determine Control-M/EM version in ${EM_HOME}"
  exit 2
fi

echo "Detected Control-M/EM version: ${VER}"

# Vulnerable: 9.0.20.x and earlier unsupported branches
MAJOR=$(echo "${VER}" | cut -d. -f1)
MINOR=$(echo "${VER}" | cut -d. -f2)
PATCH=$(echo "${VER}" | cut -d. -f3)

if [[ "${MAJOR}" -lt 9 ]]; then
  echo "VULNERABLE: pre-9.x, unsupported branch"; exit 1
fi
if [[ "${MAJOR}" -eq 9 && "${MINOR}" -eq 0 && "${PATCH}" -le 20 ]]; then
  echo "VULNERABLE: 9.0.${PATCH} is in the affected/unsupported range for CVE-2026-10540"; exit 1
fi

echo "PATCHED: ${VER} is outside the documented affected range. Confirm against BMC advisory for exact fix build."
exit 0

Sources

1. BMC Software — Security Advisories
2. NVD — CVE-2026-10540 (once published)
3. MITRE CVE record — CVE-2026-10540
4. CWE-328: Use of Weak Hash
5. CWE-916: Use of Password Hash With Insufficient Computational Effort
6. CISA KEV Catalog
7. FIRST EPSS
8. hashcat — password recovery reference