Control-M Server Command Injection via Unsanitized Input

CVE-2026-10539 is a critical command injection vulnerability in BMC Control-M/Server that allows unauthenticated attackers to execute arbitrary commands through insufficient input validation in server communication handlers. This vulnerability carries a CVSS score of 9.0, reflecting its severe impact potential. Organizations running Control-M/Server versions 9.0.20.x through 9.0.21.200 are immediately at risk, as are those on earlier unsupported versions. Control-M is widely deployed in enterprise environments for job scheduling and workflow automation, making this vulnerability particularly dangerous—successful exploitation could grant attackers complete server compromise and lateral movement capabilities within critical infrastructure and financial systems.

While this CVE currently has zero matching Casky skills, the underlying attack pattern falls within command injection and input validation bypass categories that Casky's extended reasoning capabilities would identify through behavioral analysis. When deployed, Casky's Claude-powered engine would detect exploitation attempts by analyzing anomalous communication patterns to Control-M/Server, identifying malformed input sequences that bypass sanitization filters, and flagging suspicious command execution chains initiated through unauthenticated channels. Practitioners using Casky would observe findings correlating raw network traffic patterns, abnormal process execution from Control-M processes, and command-line argument structures indicative of injection payloads—providing the behavioral forensics needed to confirm compromise even when traditional signature-based detection fails. Organizations should prioritize immediate patching and implement network segmentation around Control-M infrastructure while monitoring for exploitation indicators.