CVE-2026-23781

critical · 9.8

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.

9.8

CVSS

0.3%

EPSS (exploit prob.)

21st

EPSS percentile

2026-04-10

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
bmc	control-m/managed_file_transfer	>= 9.0.20, <= 9.0.22

Check a specific version with /api/v1/cve/match.

References

https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9022/Patches/Control-M-MFT-PAAFP-9-0-22-025/
https://www.bmc.com/support/resources/issue-defect-management.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-23781