An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.
References
Configurations
History
27 Apr 2026, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:bmc:control-m\/managed_file_transfer:*:*:*:*:*:*:*:* | |
| References | () https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-308/?srid=ab0apVT3 - Patch | |
| References | () https://www.bmc.com/support/resources/issue-defect-management.html - Vendor Advisory | |
| First Time |
Bmc control-m\/managed File Transfer
Bmc |
14 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
10 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 15:16
Updated : 2026-04-27 19:11
NVD link : CVE-2026-23782
Mitre link : CVE-2026-23782
CVE.ORG link : CVE-2026-23782
JSON object : View
Products Affected
bmc
- control-m\/managed_file_transfer
CWE
CWE-284
Improper Access Control