# cve.now: BMC

The newest entries naming BMC as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-113697](https://cve.now/CVE-2026-113697.md): Reflected Cross-Site Scripting in BMC Helix Operations Management (CVSS 4.8)
- [CVE-2026-113696](https://cve.now/CVE-2026-113696.md): Improper Authorization in BMC ITSM SmartIT Change Approvals (CVSS 5.3)
- [CVE-2026-113695](https://cve.now/CVE-2026-113695.md): Reflected Cross-Site Scripting in BMC ITSM SmartIT (CVSS 4.8)
- [CVE-2026-113694](https://cve.now/CVE-2026-113694.md): Improper Authorization in BMC ITSM SmartIT Attachments (CVSS 5.3)
- [CVE-2026-113693](https://cve.now/CVE-2026-113693.md): System Account Credential Disclosure in BMC ITSM (CVSS 5.3)
- [CVE-2026-113692](https://cve.now/CVE-2026-113692.md): Path Traversal in BMC ITSM (CVSS 6.9)
- [CVE-2026-113691](https://cve.now/CVE-2026-113691.md): Stored Cross-Site Scripting in BMC ITSM Knowledge Articles (CVSS 5.1)
- [CVE-2026-113690](https://cve.now/CVE-2026-113690.md): Stored Cross-Site Scripting in BMC ITSM Attachments (CVSS 4.8)
- [CVE-2026-113689](https://cve.now/CVE-2026-113689.md): Stored Cross-Site Scripting in BMC ITSM Work Notes (CVSS 5.1)
- [CVE-2026-113688](https://cve.now/CVE-2026-113688.md): Server-Side Request Forgery in BMC ITSM SmartIT (CVSS 5.3)
- [CVE-2026-10537](https://cve.now/CVE-2026-10537.md): Remote unauthenticated information disclosure and denial of service due to unauthenticated service access (CVSS 6.9)
- [CVE-2026-10538](https://cve.now/CVE-2026-10538.md): Improper deserialization handling in Control-M Components (CVSS 8.9)
- [CVE-2026-10539](https://cve.now/CVE-2026-10539.md): Unauthenticated command injection in Control-M/Server communication command (CVSS 9.5)
- [CVE-2026-10540](https://cve.now/CVE-2026-10540.md): Weak password hash protection in Control-M/Entreprise Manager (CVSS 5.6)
- [CVE-2025-55108](https://cve.now/CVE-2025-55108.md): BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution (CVSS 9.5)
- [CVE-2025-55118](https://cve.now/CVE-2025-55118.md): BMC Control-M/Agent memory corruption in SSL/TLS communication (CVSS 8.4)
- [CVE-2025-55117](https://cve.now/CVE-2025-55117.md): BMC Control-M/Agent buffer overflow in SSL/TLS communication (CVSS 6.3)
- [CVE-2025-55116](https://cve.now/CVE-2025-55116.md): BMC Control-M/Agent buffer overflow local privilege escalation (CVSS 9.3)
- [CVE-2025-55115](https://cve.now/CVE-2025-55115.md): BMC Control-M/Agent path traversal local privilege escalation (CVSS 9.3)
- [CVE-2025-55114](https://cve.now/CVE-2025-55114.md): BMC Control-M/Agent improper IP address filtering order (CVSS 6.9)
- [CVE-2025-55113](https://cve.now/CVE-2025-55113.md): BMC Control-M/Agent unescaped NULL byte in access control list checks (CVSS 9.5)
- [CVE-2025-55112](https://cve.now/CVE-2025-55112.md): BMC Control-M/Agent hardcoded Blowfish keys (CVSS 7.6)
- [CVE-2025-55111](https://cve.now/CVE-2025-55111.md): BMC Control-M/Agent insecure default file permissions (CVSS 5.7)
- [CVE-2025-55110](https://cve.now/CVE-2025-55110.md): BMC Control-M/Agent hardcoded default keystore password (CVSS 5.7)
- [CVE-2025-55109](https://cve.now/CVE-2025-55109.md): BMC Control-M/Agent default SSL/TLS configuration authenticated bypass (CVSS 9.5)
- [CVE-2025-48709](https://cve.now/CVE-2025-48709.md): BMC Control-M/Server cleartext database credentials in process lists and logs (CVSS 4.8)
- [CVE-2021-35002](https://cve.now/CVE-2021-35002.md): BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2021-35001](https://cve.now/CVE-2021-35001.md): BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability (CVSS 3.1)
- [CVE-2024-1606](https://cve.now/CVE-2024-1606.md): HTML injection in BMC Control-M (CVSS 4.6)
- [CVE-2024-1605](https://cve.now/CVE-2024-1605.md): DLL side-loading in BMC Control-M (CVSS 6.6)
- [CVE-2024-1604](https://cve.now/CVE-2024-1604.md): Incorrect authorization in BMC Control-M (CVSS 6.4)
- [CVE-2022-35865](https://cve.now/CVE-2022-35865.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. (CVSS 7.3)
- [CVE-2022-35864](https://cve.now/CVE-2022-35864.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. (CVSS 5.3)
- [CVE-2022-24047](https://cve.now/CVE-2022-24047.md): This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bmc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.