ZeroDay Findings
Sign inSign up

Findings

CVE-2026-23782

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22.

Published Apr 10, 2026 · updated Jun 17, 2026 · bmc control-m/managed file transfer

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 10, 2026 · NIST NVD

    Detected

    An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.

  2. Jun 17, 2026 · NIST NVD

    Updated

    An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.

Affected

  • cpe bmc/control-m/managed file transferversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-23782

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-23782

    An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potenti

    nvd.nist.gov

References