CVE-2026-10538: Control-M Deserialization RCE Vulnerability – Patch Guidance

Technical summary

The vulnerability stems from unsafe deserialization practices in Control-M's messaging consumer component (CWE-502). When the system processes serialized objects submitted by authenticated users, it does not enforce adequate whitelisting or validation of permissible object types. This allows an attacker to craft malicious serialized payloads that, upon deserialization, instantiate unintended objects and execute arbitrary logic within the server's context. The attack requires network access and valid authentication credentials, but does not require user interaction. The broad impact vector (affecting confidentiality, integrity, and availability across system boundaries) indicates the attacker can potentially pivot to other systems or exfiltrate sensitive data.

Business impact

Organizations running out-of-support Control-M versions face significant operational risk. A compromised Control-M environment can disrupt critical job scheduling and workflow automation across enterprise systems. Attackers gaining code execution can modify job definitions, steal credentials stored in Control-M's vault, or use the server as a pivot point to lateral movement. For businesses dependent on Control-M for financial transaction processing, data pipelines, or compliance-driven batch operations, exploitation could result in data breaches, service outages, and regulatory violations.

Affected systems

Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x are confirmed affected; earlier versions are likely vulnerable but not explicitly confirmed in available advisories. The vulnerability requires an authenticated attacker, so it poses greatest risk to organizations where Control-M credentials have been compromised or where internal users are malicious. Verify your specific version against the vendor advisory; products before 9.0.20.x should be assessed for applicability.

Exploitability

Exploitation requires valid Control-M credentials, which increases the barrier compared to unauthenticated attacks. However, the lack of user interaction and network accessibility make this practical for insiders or attackers who have already obtained valid credentials through phishing, credential theft, or lateral movement. The High CVSS score (8.0) reflects the combination of high impact and relatively low attack complexity once authentication is achieved. The vulnerability is not yet in CISA's KEV catalog, suggesting active exploitation in the wild has not been widely documented at time of publication.

Remediation

The most effective mitigation is to upgrade Control-M/Server and Control-M/Enterprise Manager to a supported version that includes the security patch. Organizations unable to upgrade immediately should implement network segmentation to restrict unauthenticated access to Control-M ports, enforce strong password policies and multi-factor authentication for Control-M accounts, and monitor for suspicious serialized payloads in messaging logs. Out-of-support versions are no longer receiving security updates, making upgrade urgency critical.

Patch guidance

Contact your BMC Software support team or consult the official Control-M security advisory to identify the patched version for your current deployment. Verify the patch version against the vendor advisory before deployment. Test patches in a non-production environment first, as Control-M is typically mission-critical. Plan upgrades carefully to minimize scheduling disruption. If you are running version 9.0.20.x or earlier, prioritize this patch in your vulnerability management queue given the HIGH severity and broad impact.

Detection guidance

Monitor Control-M message queues and serialized object logs for anomalous patterns, such as deserialization of unexpected object types or failures in object instantiation. Enable detailed audit logging on the messaging consumer component if available. Network-based detection should flag unusual outbound connections from Control-M servers, which may indicate lateral movement post-exploitation. Intrusion detection systems should be tuned to detect Java deserialization gadget chains if Control-M is Java-based. Review Control-M user access logs for unusual authentication patterns or privilege escalation attempts.

Why prioritize this

This vulnerability merits immediate attention for organizations running Control-M versions 9.0.20.x or earlier. The HIGH CVSS score combined with broad system impact (C/I/A across system boundaries) and the fact that Control-M typically manages critical enterprise workflows make this a top-tier priority. While authentication is required, out-of-support status means no future patches will be released; upgrade or retire affected systems are the only sustainable options.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects: (1) Network-based attack vector with no special network requirements; (2) High attack complexity due to authentication requirement; (3) High privileges required (authenticated user); (4) No user interaction needed; (5) System-scoped impact affecting confidentiality, integrity, and availability across trust boundaries. The score appropriately captures the combination of low accessibility (requires credentials) with severe impact (full system compromise). Organizations should not downweight this score based on the authentication requirement; lateral movement often provides attackers with internal credentials.

Frequently asked questions