An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable arbitrary file read/write operations and potentially lead to remote code execution.
References
Configurations
History
27 Apr 2026, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:bmc:control-m\/managed_file_transfer:*:*:*:*:*:*:*:* | |
| References | () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9022/Patches/Control-M-MFT-PAAFP-9-0-22-025/ - Patch | |
| References | () https://www.bmc.com/support/resources/issue-defect-management.html - Vendor Advisory | |
| First Time |
Bmc control-m\/managed File Transfer
Bmc |
14 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-89 |
10 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 15:16
Updated : 2026-04-27 19:11
NVD link : CVE-2026-23780
Mitre link : CVE-2026-23780
CVE.ORG link : CVE-2026-23780
JSON object : View
Products Affected
bmc
- control-m\/managed_file_transfer
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')