CVE-2023-26550

CRITICAL 9.8CVE-2023-26550 · Published 25/02/2023 · updated 17/06/2026

In short

CVE-2023-26550 is a CRITICAL (CVSS 9.8) vulnerability affecting control-m (bmc).
Chance of exploitation in the next 30 days (EPSS): 0.75%, higher than 55.0% of all vulnerabilities.
Fix: update to 9.0.20.214 or later.

Package	Affected versions	Patched versions
control-m bmc	`< 9.0.20.214`	`9.0.20.214`

A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.