An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.
References
Configurations
History
27 Apr 2026, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9022/Patches/Control-M-MFT-PAAFP-9-0-22-025/ - Patch | |
| References | () https://www.bmc.com/support/resources/issue-defect-management.html - Vendor Advisory | |
| CPE | cpe:2.3:a:bmc:control-m\/managed_file_transfer:*:*:*:*:*:*:*:* | |
| First Time |
Bmc control-m\/managed File Transfer
Bmc |
14 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-798 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
10 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 16:16
Updated : 2026-04-27 19:11
NVD link : CVE-2026-23781
Mitre link : CVE-2026-23781
CVE.ORG link : CVE-2026-23781
JSON object : View
Products Affected
bmc
- control-m\/managed_file_transfer
CWE
CWE-798
Use of Hard-coded Credentials