BMC vulnerabilities
34 CVEs and advisories name BMC as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-113697Reflected Cross-Site Scripting in BMC Helix Operations Management
- CVE-2026-113696Improper Authorization in BMC ITSM SmartIT Change Approvals
- CVE-2026-113695Reflected Cross-Site Scripting in BMC ITSM SmartIT
- CVE-2026-113694Improper Authorization in BMC ITSM SmartIT Attachments
- CVE-2026-113693System Account Credential Disclosure in BMC ITSM
- CVE-2026-113692Path Traversal in BMC ITSM
- CVE-2026-113691Stored Cross-Site Scripting in BMC ITSM Knowledge Articles
- CVE-2026-113690Stored Cross-Site Scripting in BMC ITSM Attachments
- CVE-2026-113689Stored Cross-Site Scripting in BMC ITSM Work Notes
- CVE-2026-113688Server-Side Request Forgery in BMC ITSM SmartIT
- CVE-2026-10537Remote unauthenticated information disclosure and denial of service due to unauthenticated service access
- CVE-2026-10538Improper deserialization handling in Control-M Components
- CVE-2026-10539Unauthenticated command injection in Control-M/Server communication command
- CVE-2026-10540Weak password hash protection in Control-M/Entreprise Manager
- CVE-2025-55108BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution
- CVE-2025-55118BMC Control-M/Agent memory corruption in SSL/TLS communication
- CVE-2025-55117BMC Control-M/Agent buffer overflow in SSL/TLS communication
- CVE-2025-55116BMC Control-M/Agent buffer overflow local privilege escalation
- CVE-2025-55115BMC Control-M/Agent path traversal local privilege escalation
- CVE-2025-55114BMC Control-M/Agent improper IP address filtering order
- CVE-2025-55113BMC Control-M/Agent unescaped NULL byte in access control list checks
- CVE-2025-55112BMC Control-M/Agent hardcoded Blowfish keys
- CVE-2025-55111BMC Control-M/Agent insecure default file permissions
- CVE-2025-55110BMC Control-M/Agent hardcoded default keystore password
- CVE-2025-55109BMC Control-M/Agent default SSL/TLS configuration authenticated bypass
- CVE-2025-48709BMC Control-M/Server cleartext database credentials in process lists and logs
- CVE-2021-35002BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability
- CVE-2021-35001BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability
- CVE-2024-1606HTML injection in BMC Control-M
- CVE-2024-1605DLL side-loading in BMC Control-M