CVE-2026-10538

Name of the Vulnerable Software and Affected Versions Control-M/Server versions 9.0.20.x and earlier Control-M/Enterprise Manager versions 9.0.20.x and earlier

Description Messaging consumer functionality allows unsafe deserialization of user-controlled data without sufficient restriction of allowed object types. This may enable an authenticated attacker to trigger unintended server-side behavior by providing crafted serialized content. Deserialization is the process of converting a data format, such as JSON or XML, back into an object that can be used by a program.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.