CVE-2026-23780 - An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22

Back Back to CVE browser

HIGH

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22

Published Apr 10, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.40%

Description

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable arbitrary file read/write operations and potentially lead to remote code execution.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

Link	Providers	Tags
https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9022/Patches/Control-M-MFT-PAAFP-9-0-22-025/		Patch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21370		Advisory
https://www.bmc.com/support/resources/issue-defect-management.html		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 10, 2026

Updated Apr 14, 2026

Reserved Jan 16, 2026

Link CVE-2026-23780

CISA Vulnrichment

Updated Apr 14, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-23780

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Apr 10, 2026

Updated Apr 14, 2026

Link EUVD-2026-21370

GitHub

No data