Loading story…
BMC Control-M deployments are affected by two newly disclosed vulnerabilities that expose Control-M/Server and related components to serious remote attacks. CVE-2026-10539 is a critical unauthenticated command injection flaw in Control-M/Server communication commands that can let a remote attacker execute unauthorized commands and potentially fully compromise a server. The issue affects Control-M/Server versions 9.0.20.x through 9.0.21.200, and possibly earlier unsupported releases, and is rated CVSS 4.0 9.5 / CVSS 3.1 9.0.
A second issue, CVE-2026-10538, is a high-severity improper deserialization vulnerability in out-of-support Control-M/Server and Control-M/Enterprise Manager 9.0.20.x components, particularly in messaging consumer functionality that processes user-controlled serialized data. An authenticated attacker could remotely trigger unintended server-side behavior through crafted serialized content; the flaw is rated CVSS 4.0 8.9 / CVSS 3.1 8.0. Organizations running affected Control-M versions have been advised to upgrade to supported releases, apply vendor patches, harden deserialization controls, restrict access to exposed services, and monitor for suspicious command execution or messaging activity.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A critical unauthenticated command injection vulnerability in Control-M/Server communication commands was published as CVE-2026-10539. The flaw affects Control-M/Server versions 9.0.20.x through 9.0.21.200 inclusive and could allow remote attackers to execute unauthorized commands on affected servers.
A high-severity improper deserialization vulnerability affecting out-of-support BMC Control-M/Server and Control-M/Enterprise Manager 9.0.20.x and potentially earlier versions was published as CVE-2026-10538. The issue allows an authenticated remote attacker to trigger unintended server-side behavior via crafted serialized content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
my.f5.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026
Cisco disclosed command injection and remote code execution vulnerabilities affecting **Cisco Integrated Management Controller (CIMC)**, warning that the flaws could allow an attacker to execute arbitrary commands or code on impacted systems. The advisory identifies the issue as affecting CIMC and frames it as a serious compromise path into server management infrastructure, where successful exploitation could give an attacker control over administrative functions and underlying devices. The vulnerabilities were published in a Cisco security advisory under the topic **"Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities."** Organizations using Cisco CIMC are expected to review the vendor advisory, determine whether exposed or internet-reachable management interfaces are affected, and apply Cisco-provided fixes or mitigations to reduce the risk of unauthorized command execution on management controllers.
Jun 29, 2026
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026