CVE-2026-23780

HIGH 8.8CVE-2026-23780 · Published 10/04/2026 · updated 17/06/2026

In short

CVE-2026-23780 is a HIGH (CVSS 8.8) vulnerability affecting control-m/managed file transfer (bmc).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
control-m/managed file transfer bmc	`≥ 9.0.20, ≤ 9.0.22`	No fix yet

Description

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable arbitrary file read/write operations and potentially lead to remote code execution.

References

docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9022/Patches/Control-M-MFT-PAAFP-9-0-22-025 · Patch
bmc.com/support/resources/issue-defect-management.html · Vendor Advisory

More vulnerabilities in control-m/managed file transfer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free