CVE-2026-10538 – Improper deserialization handling in Control-M Components

CVE ID :CVE-2026-10538

Published : July 1, 2026, 7:56 a.m. | 1 hour, 50 minutes ago

Description :Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

Severity: 8.9 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…