CVE-2025-55108

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in the default configuration). NOTE:  * The vendor believes that this vulnerability only occurs when documented security best practices are not followed. BMC has always strongly recommended to use security best practices such as configuring SSL/TLS between Control-M Server and Agent. * The vendor notifies that Control-M/Agent is not impacted in Control-M SaaS

• CWE-306

• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000441962
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099
• https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442271

Published

Nov 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55102A denial-of-service vulnerability exists in the NetX IPv6 co…7.5
• CVE-2025-55103There is a stored Cross-site Scripting vulnerability in Esri…4.8
• CVE-2025-55104A stored cross-site scripting (XSS) vulnerability exists Arc…4.8
• CVE-2025-55105There is a stored Cross-site Scripting vulnerability in Esri…4.8
• CVE-2025-55106There is a stored Cross-site Scripting vulnerability in Esri…4.8
• CVE-2025-55107There is a stored Cross-site Scripting vulnerability in Es…4.8
• CVE-2025-55109An authentication bypass vulnerability exists in the out-of-…9.5
• CVE-2025-5511A vulnerability, which was classified as critical, has been …7.5
• CVE-2025-55110Control-M/Agents use a kdb or PKCS#12 keystore by default, a…5.7
• CVE-2025-55111Certain files with overly permissive permissions were identi…5.7
• CVE-2025-55112Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (an…7.6
• CVE-2025-55113If the Access Control List is enforced by the Control-M/Agen…10