BMC Control-M/Agent: unauthenticated remote code execution when mutual TLS is not enabled

Impact

In the default configuration, where mutual SSL/TLS between Control-M Server and Agent is not turned on, anyone who can reach an agent's listening port gets unauthenticated remote code execution plus arbitrary file read and write as the agent account. Control-M agents are installed broadly across datacenter hosts to run batch and data-pipeline work, so a single reachable agent is a foothold on a production node, and the agent account typically holds job credentials and shared filesystem mounts. Where agents run on or beside GPU nodes that drive scheduled training and ETL jobs, this also lets an attacker alter what those jobs execute. The vendor states Control-M SaaS is not impacted and considers the issue to arise only when its documented TLS guidance is not followed.

Who can reach it

Any network peer able to reach the Control-M/Agent port - no credentials needed. Exposure depends entirely on whether the agent network is segmented and whether mutual TLS is configured.

What to do

Enable mutual SSL/TLS between Control-M Server and Agent as BMC documents, then restart the agent service on each host; restrict the agent port to the Control-M Server addresses in the meantime. Follow the BMC knowledge articles linked in the record for the per-version steps - no fixed version number is stated in this record, so treat configuration hardening as the fix.

References

Related entries

• BMC Helix Network Management: SAML login path accepts any password for the local administratorCVE-2026-111283 · BMC Helix Network Management (on-prem web login, SAML SSO path)Critical
• Arista EOS P4Runtime: unauthenticated client can gain full administrative control of the switchCVE-2026-73453 · Arista EOS (P4Runtime service)Critical
• Juniper Junos Space: stored XSS lets a low-privileged user run commands as a viewing administratorCVE-2025-59978 · Juniper Junos Space (web UI stored cross-site scripting)Critical
• Arista EOS gNSI Certz: crafted Rotate request runs arbitrary OS commands as rootCVE-2026-73447 · Arista EOS (gNSI Certz service, also Bootz)Critical
• Arista EOS: gRPC OpenConfig requests authorized at the wrong privilege levelCVE-2026-73461 · Arista EOS (AAA authorization for gRPC/OpenConfig)Critical
• Lantronix console servers: command injection in the NFS download CLI yields root on the out-of-band management deviceCVE-2026-80151 · Lantronix SLC8000/SLC9000/EMG console servers (CLI 'set nfs download' command)Critical